How often do I have to affirm?

After every assessment, including a POA&M closeout, and annually thereafter. For a Level 2 self-assessment that means affirming when you complete the assessment, each year after your final status date, and again after the three-year reassessment.

Where is the affirmation submitted?

In SPRS, the Supplier Performance Risk System. The regulation says all affirmations are completed there and that the Department will verify submission.

Can my IT provider or consultant sign the affirmation?

The regulation describes the Affirming Official as a senior-level representative from within the organization seeking assessment, with responsibility for and authority over its compliance. An outside provider does not fit that description.

Do subcontractors have to affirm too?

Yes. The requirement applies to each organization seeking assessment, whether it is a prime contractor or a subcontractor.

Guide

The CMMC affirmation: who signs, what they attest, and when

Posting a score is only half of a CMMC self-assessment. The other half is a signed statement, called an affirmation, that a senior person in your company enters in SPRS. It is the part that puts a name behind the number, so it is worth understanding before anyone clicks submit.

Written by WorkuGRC. Last updated November 12, 2026.

The short version

A senior official of your company, the Affirming Official, makes the affirmation.
They state that the company has implemented and will maintain the requirements.
It is entered in SPRS after every assessment and every year after that.
It is required before a contract that needs the CMMC level can be awarded.

What the affirmation says

The regulation requires two things in each affirmation: the name, title, and contact information of the Affirming Official, and a statement that your organization has implemented, and will maintain implementation of, all applicable CMMC security requirements for every information system in the scope you assessed.

Note the two tenses. It is a statement about today and a commitment about the future. That is why an honest score matters more than a high one: the person signing is vouching for it.

Who can sign

The regulation calls this person the Affirming Official and describes them as the senior-level representative from within the organization who is responsible for ensuring its compliance with the CMMC requirements and who has the authority to affirm it. At a small shop that is usually the owner or a senior manager.

Two practical points follow from that wording. The person comes from within your company, so an outside IT provider or consultant does not fit the description. And the rule applies to each organization, whether it is a prime contractor or a subcontractor.

When it is required

In general terms, after every assessment (including a POA&M closeout) and annually after that. By level:

Level 1 (self-assessment): when you complete the self-assessment, and annually thereafter. The Level 1 self-assessment itself is also annual.
Level 2 (self-assessment): when you complete the self-assessment, again when you complete a POA&M closeout self-assessment if you had a POA&M, and annually following your final status date. The Level 2 self-assessment itself is repeated every three years.

So for a Level 2 self-assessment the rhythm is: assess and affirm, then affirm again each year, then reassess in year three.

Where it goes, and what else is entered

All affirmations are completed in SPRS, the Supplier Performance Risk System, and the Department says it will verify there that the affirmation was submitted. For a Level 2 self-assessment, the results entered in SPRS include at least:

the CMMC level;
the CMMC status date;
the assessment scope;
the CAGE codes for the systems in that scope;
the overall score (for example, 105 out of 110);
whether a POA&M is in use and its status.

Keep your working papers. The regulation requires the assessment artifacts to be retained for six years from the status date.

Why it matters for winning work

Before a contract that requires Level 2 (Self) can be awarded, your company must have both a conditional or final Level 2 (Self) status and an affirmation submitted in SPRS. Level 1 works the same way. Without the affirmation, the score alone does not satisfy the requirement.

If things change after you sign

The regulation is specific about two situations:

A conditional status that is not closed out. If the POA&M is not closed within 180 days, the conditional status expires. If that happens during a contract, standard contractual remedies apply and the company is ineligible for further awards needing that status until it achieves a new one. See the POA&M rules.
A government check that disagrees with you. The Department may have its own assessors (DCMA DIBCAC) assess your systems. If they find the requirements were not achieved or maintained, their results take precedence over your existing status.

The sections cited on this page do not spell out a separate penalty for an annual affirmation that is simply late. What they do say is that the affirmation is a condition of award and that the Department verifies it, so treat the anniversary as a hard date.

Separately from CMMC, in March 2025 the Department of Justice announced a $4.6 million False Claims Act settlement with a defense contractor whose reported score overstated what was in place. Read the Justice Department release. What that means for your company is a question for your counsel, not for this page.

Before you affirm: a short checklist

The score in SPRS matches your actual answers, requirement by requirement.
Your System Security Plan describes what is really in place.
Any open gaps are on a POA&M, and they are the kind that may be deferred.
The person signing has read the SSP and the gap list, not only the score.
You have put next year's affirmation date on a calendar.

WorkuGRC helps with the first three: it calculates a self-assessment score from your answers, drafts the SSP and POA&M, and lists every assessment objective with the status you recorded so the signer can see what they are vouching for. It is a drafting tool. It does not submit anything to SPRS and it does not verify your answers.

Regulatory status — current as of November 12, 2026

Level 1 and Level 2 self-assessments, with their affirmations, are in effect. Phase 2 (third-party C3PAO certification for Level 2) was suspended on July 13, 2026 and is under government review. Rules change; confirm the current text at 32 CFR 170.22 and the DoD CMMC page.

Frequently asked questions

Who is the Affirming Official for CMMC?: The senior-level representative from within the organization who is responsible for ensuring its compliance with the CMMC requirements and has the authority to affirm it. At a small company this is usually the owner or a senior manager.
How often do I have to affirm?: After every assessment, including a POA&M closeout, and annually thereafter. For a Level 2 self-assessment that means affirming when you complete the assessment, each year after your final status date, and again after the three-year reassessment.
Where is the affirmation submitted?: In SPRS, the Supplier Performance Risk System. The regulation says all affirmations are completed there and that the Department will verify submission.
Can my IT provider or consultant sign the affirmation?: The regulation describes the Affirming Official as a senior-level representative from within the organization seeking assessment, with responsibility for and authority over its compliance. An outside provider does not fit that description.
Do subcontractors have to affirm too?: Yes. The requirement applies to each organization seeking assessment, whether it is a prime contractor or a subcontractor.

Know what you are signing.

Get a self-assessment score from your own answers, a draft SSP and POA&M, and a list of every assessment objective with the status you recorded. Free.

Start free →

Informational only — not a compliance determination, an assessment, or legal advice. Requirements are defined by NIST SP 800-171 Rev 2, NIST SP 800-171A, the DoD Assessment Methodology, and 32 CFR Part 170; always verify against the official publications.