If you self-assessed under CMMC Phase 1 last fall, you might think the work is done — you scored yourself, you submitted to SPRS, you moved on. It isn't done. CMMC compliance comes with a recurring legal obligation that most small contractors don't find out about until it's almost due: the annual affirmation.
It's a short requirement on paper — one attestation, submitted electronically. But it has to be signed by a specific person, it has to happen on a specific cadence, and missing it can knock you out of contract eligibility even if your security posture hasn't changed at all. Here's what it actually requires.
What Is a CMMC Affirmation?
An affirmation is a statement — submitted electronically in the Supplier Performance Risk System (SPRS) — in which a senior executive at your company attests that you have implemented, and will continue to maintain, every security requirement tied to your CMMC status. It's defined in the CMMC rule at 32 CFR § 170.22.
It is not a re-assessment. You're not re-scoring all 110 controls or re-running your self-assessment. You're confirming, in a legally binding way, that nothing has slipped since the last time you assessed or affirmed.
When Do You Have to Submit One?
The rule lists four triggers. You submit a CMMC affirmation:
- Upon achieving a Conditional CMMC Status (if you used a POA&M to pass);
- Upon achieving a Final CMMC Status;
- Annually following your Final CMMC Status Date; and
- Following any POA&M closeout assessment.
The part contractors miss is #3. It's not a one-time event tied to passing your assessment — it repeats every 12 months for as long as you hold that status, regardless of which CMMC level or assessment type you're working under.
| Your CMMC Status | Affirmation Cadence |
|---|---|
| Level 1 (Self) | At self-assessment completion, then every 12 months for as long as you hold that status. |
| Level 2 (Self) | At self-assessment completion, then every 12 months; an additional affirmation after any POA&M closeout self-assessment. |
| Level 2 (C3PAO Certified) | At certification, then every 12 months — even though the certification itself is valid for three years; an additional affirmation after any POA&M closeout assessment. |
| Level 3 (DIBCAC) | At certification, then every 12 months — and you must affirm both your Level 3 status and your underlying Level 2 (C3PAO) status, since they're assessed against different requirements. |
Self-Assessment, Certification, and Affirmation Aren't the Same Clock
These three things get blended together in conversation, but they answer different questions:
| Mechanism | What It Answers |
|---|---|
| Self-assessment | "Did we score ourselves against the controls and submit the result to SPRS?" |
| C3PAO certification | "Did an independent third party verify our controls and issue a status valid for three years?" |
| Affirmation | "Has a senior executive attested, in SPRS, that we are still in compliance — right now?" |
You can owe an affirmation even in a year where you're not required to do a new self-assessment or assessment. The affirmation is the constant; the assessment cadence varies by level and path.
The affirmation requirement exists specifically so the government isn't relying on a snapshot from three years ago. Signing it inaccurately — claiming continuing compliance you can't actually back up — exposes the Affirming Official personally, and the company, to False Claims Act liability. This is the part of CMMC where "pencil whipping" carries real legal risk, not just a failed audit.
What Happens If You Miss the Deadline?
There's no fine that arrives in the mail. The consequence is commercial, and it shows up the moment someone checks: the Department verifies affirmation status in SPRS to confirm contract eligibility. If your annual affirmation has lapsed, your CMMC Status is no longer treated as current — which means you can be deemed ineligible for contracts or task orders that require it, even if every control is still in place exactly as it was on assessment day.
For a small sub, that's the scenario that actually bites: not a penalty, but a prime quietly routing the next award to a competitor whose SPRS record shows a clean, current affirmation and yours doesn't.
Don't let a date slip past you
CMMC Map tracks your Final CMMC Status Date, your assessment history, and your evidence in one place — so you know exactly when your next affirmation is due and what you're attesting to when you sign it.
Start Your Free 7-Day TrialHow to Stay Ahead of It
A few habits keep this from ever becoming a surprise:
- Put the date on a calendar the day you achieve Final CMMC Status — not the day someone reminds you. Set the reminder for 30–60 days before the 12-month mark, not the week of.
- Name your Affirming Official explicitly, in writing, and make sure they understand the legal weight of what they're signing. It should be a deliberate assignment, not "whoever's around."
- Review your SSP and evidence before every affirmation, not just before assessments. If something changed — new MSP, new cloud service, new office — the Affirming Official needs to know before they attest that nothing changed.
- Keep a record of every affirmation you've submitted, with the date and who signed it, separate from SPRS itself. If a prime or assessor asks for proof, you want it in seconds, not a SPRS login away.
The annual affirmation is a small, repeatable task — but it's also the one piece of CMMC compliance that has no grace period built in. Treat your Final CMMC Status Date the way you'd treat an insurance renewal: a fixed date, owned by a specific person, that gets handled before it becomes urgent.