Passing a CMMC assessment doesn't end the paperwork. Every year, a named senior leader at your company goes into the Supplier Performance Risk System (SPRS) and affirms that you still meet your CMMC level. That affirmation is what keeps your CMMC status current, and a current status is what keeps you eligible for contracts that require it.
Here's who signs it, what it says, when it's due, and how to get ready before anyone puts their name on it.
Who signs: the Affirming Official
Under 32 CFR 170.22, the affirmation is made by the Affirming Official. That's the senior-level representative inside your company who is responsible for your CMMC compliance and has the authority to affirm that you're still compliant.
A few things follow from that definition:
- It has to be someone inside your company. An outside consultant can't sign it for you.
- It should be someone with real authority, like an owner, president, or senior executive, not whoever happens to have SPRS access.
- Primes and subcontractors each have their own Affirming Official. A prime doesn't affirm for its subs.
What the affirmation says
Each affirmation includes two things:
- The Affirming Official's name, title, and contact information.
- A statement that your company has implemented, and will maintain, all applicable CMMC security requirements for its CMMC status, for every information system in your CMMC Assessment Scope.
That second part looks forward as well as back. You're not just saying you passed. You're saying you're compliant today and will stay that way.
When it's due
The rule ties the affirmation to four events:
- When you achieve a Conditional CMMC status (Level 2 or Level 3 with an open POA&M)
- When you achieve a Final CMMC status
- Every year after your Final CMMC Status Date
- After a POA&M closeout assessment
Here's how that looks by level:
- Level 1 (Self): You self-assess every year and affirm every year. No POA&M is allowed at Level 1, so every requirement has to be met.
- Level 2 (Self): You self-assess every three years, but you affirm after each assessment, after any POA&M closeout, and every year in between.
- Level 2 (C3PAO): Same pattern. The certification runs three years, and you affirm after the assessment, after any POA&M closeout, and every year in between.
- Level 3 (DIBCAC): You affirm after the assessment, after any POA&M closeout, and every year. You also keep affirming your Level 2 (C3PAO) status every year, because the two assessments check different requirements.
If you have a Conditional status, the POA&M has to be closed out within 180 days of your Conditional CMMC Status Date. Otherwise the Conditional status expires. Closeout triggers another affirmation.
What "current" means
DFARS 252.204-7021 is the contract clause that puts this into your contract. It requires you to complete the affirmation every year and keep it current in SPRS, for each CMMC unique identifier (CMMC UID) that covers a system used on the contract.
The clause defines a current affirmation as one that's no more than one year old, with no changes in compliance since. So the date matters, and so does what's happened in your environment since you last affirmed.
Subcontractors
Primes have to make sure their subcontractors complete an affirmation before subcontract award and keep it up every year, for each subcontractor system that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on the subcontract. If you're a sub, expect your prime to check SPRS.
Where it goes: SPRS
All affirmations are entered in SPRS, and the Department checks SPRS to confirm the affirmation is there.
Plan for access ahead of time. SPRS sits inside the Procurement Integrated Enterprise Environment (PIEE), and role approvals take time. Our SPRS explainer walks through getting access.
What happens if it lapses or isn't accurate
If it lapses: Your CMMC status stops being current. DFARS 252.204-7021 requires a current status for every system that processes, stores, or transmits FCI or CUI on the contract, and it limits that information to systems that have one. A missed affirmation can put you out of compliance with the clause and block your next award.
If it isn't accurate: The affirmation is a signed statement to the government about your cybersecurity. The Department of Justice's Civil Cyber-Fraud Initiative, announced in October 2021, uses the False Claims Act against contractors that knowingly misrepresent their cybersecurity practices. What goes into SPRS gets read, so it should match what your systems actually do.
Where CMMC stands right now
CMMC hasn't gone away. On July 13, 2026, the Department suspended the November 2026 move to Phase 2, and Class Deviation 2026-O0025, Revision 3 (September 3, 2026) tells contracting officers to remove or revise third-party CMMC requirements in solicitations and contracts. Procurements can still require Level 1 (Self) and Level 2 (Self), and both come with the annual affirmation. NIST SP 800-171 Rev. 2 under DFARS 252.204-7012 is still the baseline. Read more in our Phase 2 suspension update.
Checklist: before your Affirming Official signs
- Confirm your level and scope. Check the CMMC level in each contract and subcontract, and list every system in your CMMC Assessment Scope and its CMMC UID.
- Re-score every requirement. Assess each one against how your systems actually run today, not against last year's results.
- Check your evidence. Every requirement you claim as met should have current evidence behind it: configurations, logs, records, and screenshots.
- Update your SSP. Your System Security Plan should match the environment you're affirming, including any new systems, users, locations, or cloud services.
- Review your POA&M. If you're Conditional, confirm every item will be closed and validated within 180 days, then affirm again at closeout.
- Look for changes in compliance. If a requirement has slipped since your last affirmation, close the gap and reassess before you sign.
- Check the dates. Put your annual affirmation date and your assessment renewal date on the calendar, and leave time for PIEE and SPRS access.
- Brief the Affirming Official. They should know exactly what they're attesting to and have the evidence package in hand.
If you're a prime, add one more step: confirm in SPRS that every subcontractor handling FCI or CUI has a current affirmation before you award.
How Cyberneza helps
Our CMMC support is Expert-led and built around what your Affirming Official needs to sign. We assess every requirement for your level, map evidence to each one, update your SSP and POA&M, specify the changes needed to close any gaps, validate closure, and deliver an evidence package your Affirming Official can sign from. Certification assessments themselves come from an authorized C3PAO.
Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance firm in Orlando, Florida.
Ready to get your next affirmation right? Contact us and tell us your level and your last affirmation date.