One name on one statement
Every CMMC status ends in the same place: a named person at your company entering a statement in a government system that the company has implemented the required security and will keep it implemented. That person is the Affirming Official, and the requirement comes back every year. The statement takes minutes to enter. Being able to stand behind it takes the rest of the year.
The July 13, 2026 suspension of CMMC Phase 2 did not touch this duty. DFARS 252.204-7021 still requires a contractor to affirm annually, and Phase 1 self-assessments remain in force. For most small defense suppliers, the affirmation is now the most consequential CMMC act of the year.
What the regulation requires
The rule is 32 CFR 170.22. An Affirming Official from each organization, "whether a prime or subcontractor," must affirm continuing compliance "after every assessment, including POA&M closeout, and annually thereafter." Affirmations are entered electronically in the Supplier Performance Risk System, known as SPRS. The department checks SPRS to confirm the affirmation exists when it decides whether a company meets a solicitation or contract requirement.
DFARS 252.204-7021 turns that rule into a contract duty. A contractor must complete the affirmation on an annual basis and maintain it as current in SPRS for each CMMC unique identifier that applies to a system handling federal contract information (FCI) or controlled unclassified information (CUI). The clause defines current as not older than one year, with no changes in compliance since the status date. The unique identifier is a 10-character code SPRS assigns to each assessment and shows for each contractor information system, so a company that runs two separately assessed systems has two entries to keep current.
What the statement says
Each affirmation has two parts under 32 CFR 170.22(a)(2). The first is the name, title and contact information of the Affirming Official. The second is a statement "attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope."
The words that matter most are "will maintain," because the signer is speaking about the future as well as the present.
The words that matter most are "will maintain," because the signer is speaking about the future as well as the present. The phrase "all information systems within the relevant CMMC Assessment Scope" matters nearly as much. If the scope written in your system security plan leaves out the laptop that the quality manager uses to open customer drawings, the statement covers less than the signer believes it does.
When it comes due
The regulation lists the moments that trigger an affirmation. Annual is the one most people know, and it is only one of four.
| Trigger | Source | What it means in practice |
|---|---|---|
| Conditional status achieved | 32 CFR 170.22(a)(3)(i) | You scored at least 88 of 110 and hold a valid plan of action. Affirm at that point. |
| Final status achieved | 32 CFR 170.22(a)(3)(ii) | All requirements scored met. Affirm at that point. |
| Annually after the Final status date | 32 CFR 170.22(a)(3)(iii) | Every year while the status is in use. Level 1 also requires an affirmation annually. |
| POA&M closeout | 32 CFR 170.22(a)(3)(iv) | A new affirmation when the closeout assessment is complete. |
A Level 2 (Self) assessment itself is repeated every three years. The affirmation runs on its own shorter clock inside that cycle. Put both dates on the calendar that your contracts manager actually uses, with a reminder well ahead of each one, because a lapse in the affirmation is a lapse in the status your contract says you will maintain.
Level 1 runs tighter. A plan of action is not permitted at any time for Level 1, every requirement must be fully implemented, and the status is current only if it is no older than one year. A company at Level 1 repeats the assessment and the affirmation together each year, so the same two weeks of review apply.
Who should sign
The regulation defines the Affirming Official as "the senior level representative from within each Organization Seeking Assessment" who is "responsible for ensuring the OSA's compliance with the CMMC Program requirements and has the authority to affirm" continuing compliance. That description rules out two common shortcuts: an outside consultant, who is not from within the organization, and a junior administrator handed the login because they know the system.
In a company of 40 or 200 people, the right signer is usually the owner, president, general manager or a senior officer who runs operations. Whoever it is needs three things. They need authority over the budget and people that keep the controls running. They need a direct line to the person who operates the systems. And they need to see the evidence themselves, because the statement is theirs, and the company's name is on it.
Separate the signer from the preparer. The IT lead or outside provider assembles the evidence and writes the summary. The signer reads it, asks questions and decides. A signer who is also the only person who checked the work has no second pair of eyes.
Name a backup as well. If the official leaves or is unavailable when the date arrives, the replacement has to read the same evidence first, and a signature rushed into a gap is the one most likely to be wrong. Record the change of signer in the affirmation file so the history stays clear.
Why the signature carries weight
An affirmation is a statement to the government that it uses to decide whether you can hold a contract. Latham & Watkins, writing about the Phase 2 suspension, warned that "a false affirmation or overstatement in those affirmations may expose contractors to significant FCA liability," referring to the False Claims Act. Under that statute, knowledge includes deliberate ignorance and reckless disregard of the truth, and no proof of specific intent to defraud is required.
That definition is the reason the two weeks before signing matter. A signer who never looked has not protected the company by not knowing. The file should show that someone looked, what they found and what was done about it.
The two weeks before signing
Run this review on a fixed date each year, and write down the results. It should take a working session or two if the year's records are in order. If it takes longer, that is a finding in itself.
- Confirm the scope is still true. Walk the asset inventory and network diagram against what is actually running, including new machines, cloud accounts and remote users
- Re-read the system security plan. Each implementation statement should still describe today's tool, setting and owner
- Sample the evidence. Pull current proof for the high-value requirements: access reviews, multifactor settings, audit log reviews, patch records, backup tests and training records
- Check the score against reality. Any requirement that slipped during the year is scored not met until it is fixed
- Review the plan of action. Each open item needs an owner, a date and visible progress, and any Conditional status must close within 180 days
- Check incidents and changes. List any cyber incidents reported under DFARS 252.204-7012 and any significant change to systems since the last affirmation
- Look at your service providers. Confirm their responsibilities match what the plan says they do
- Have the signer read a one-page summary, ask questions, and record the date they reviewed it
When something changes mid-year
The clause's definition of current includes "no changes in compliance" since the status date. That language means the annual date is a ceiling on how long you can go without saying something, and a real change in your compliance does not wait for it. If a control stops working, a tool is dropped, or you move CUI to a new cloud service, fix it or record it, and rescore if the score has moved.
When a plan of action closes, the rule requires a POA&M closeout self-assessment, a posting to SPRS, and a new affirmation. If it does not close within 180 days of the Conditional status date, the Conditional status expires, and the rule says the company becomes ineligible for additional awards requiring that status until a new one is achieved.
Common failures at signing time
- Signing last year's answer. The score is carried forward and nobody retests a control that has drifted
- Treating the affirmation as an administrative task. It goes to whoever has the SPRS account, and the responsible official never sees it
- A scope that shrank on paper only. Systems are declared out of scope while CUI still reaches them by email or USB stick
- Evidence in draft. 32 CFR 170.24 says working papers, drafts and unofficial policies are not acceptable evidence
What to keep in the affirmation file
Keep one folder for each affirmation with the date, signer, score and system identifiers; the summary the signer read; the sample of evidence reviewed; the plan of action as it stood that day; and the list of changes since the previous year. Twelve months later that folder is your starting point, and if anyone ever asks why you believed the statement was true, it is your answer.
Frequently asked questions
The regulation calls for a senior level representative from within your own organization. A provider can prepare the evidence and summary, and your senior official reviews it and makes the affirmation.
Yes, where a contract requires a CMMC status. The suspension stopped Phase 2 and later milestones. DFARS 252.204-7021 still requires annual affirmation of the status the contract names.
Fix the gap or correct the record before anyone affirms. The status and score in SPRS should reflect what is true on the day the statement is made.
Yes. 32 CFR 170.22 requires an affirmation from each organization, whether prime or subcontractor, and DFARS 252.204-7021 requires a contractor to ensure its suppliers handling FCI or CUI maintain their affirmations annually.