Terms / Certification

Affirmation

The annual statement by a senior official that you still meet the requirements. It is entered in SPRS and it carries personal weight.

Also called affirmations, affirmation of continuous compliance, affirming official.

Official Source Material

The OSA must affirm continuing compliance with the appropriate level self-assessment or certification assessment. An Affirming Official from each OSA, whether a prime or subcontractor, must affirm the continuing compliance of their respective organizations with the specified security requirement after every assessment, including POA&M closeout, and annually thereafter. Affirmations are entered electronically in SPRS.

Source: 32 CFR 170.22(a), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

The affirmation is the obligation companies forget, and it is annual.

Your status may last three years. The affirmation does not. Section 170.22 requires one after every assessment, including after a POA&M closeout, and every year after that. It is entered in SPRS. A missed affirmation undermines a status you otherwise hold.

A named senior official signs, and the choice of person matters.

The affirming official is the senior representative responsible for your compliance with the program, with authority to affirm it. This is not a task to delegate to whoever holds the account. The signer needs to be someone who can actually find out whether the requirements are still met, and who understands what they are attesting to.

The statement is about continuing compliance, not about the past.

The affirmation attests that you have implemented and will maintain all applicable requirements for every system in your scope. It speaks to today. Signing it while knowing a control has lapsed is a false statement to the Government, and the Department of Justice pursues misrepresentation under the False Claims Act.

Build a check that happens before the signature, every year.

The signature should follow a review, not replace one. Confirm the scope has not changed, confirm the controls still run, confirm your evidence still exists, and then sign. A short annual review makes the affirmation defensible and usually finds something worth fixing.

What falls short

An affirmation signed from a calendar reminder with no review behind it. The statement is about current compliance.
A signature by someone without authority to affirm for the organization. The rule names a senior representative responsible for compliance.
An affirmation covering a scope that has since changed. The statement covers the systems in the assessment scope as it stands.

Edge cases

You are a subcontractor. The rule applies to you whether you are a prime or a subcontractor, and your customer must confirm your affirmation before awarding.
You hold a conditional certification. An affirmation is required after the assessment and again after the closeout.
Your system changes materially during the year. Your affirming official owns the judgement about whether the change affects compliance.

Over-engineering

A legal review before each annual affirmation. A documented internal review by the people running the controls is what the statement rests on.
A compliance platform bought to track one annual date per system. A calendar entry with a named owner does it.

Connects to

Plan of Action and Milestones (POA&M) A POA&M lists the CMMC requirements you have not met, who fixes each one, and by when. It buys a Conditional status and 180 days, not a pass. Assessment
SPRS The Supplier Performance Risk System. It holds your NIST SP 800-171 score, your CMMC status, and the annual affirmation you sign. Assessment
Scope The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length. Scope and assets
Evidence What you show an assessor to prove a requirement is met. It must be final, not draft, and it must match what your plan claims. Assessment
Subcontractor Any company furnishing supplies or services under a prime contract. CMMC reaches every tier that handles FCI or CUI, not just the first. The contract
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification

Referenced by

CMMC The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract. Certification
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification
Final certification The status you hold when every requirement is met. It lasts one year at Level 1 and three years at Level 2 and Level 3. Certification
Level 1 The 15 basic safeguarding requirements for FCI, assessed by you every year. No plan of action is permitted at Level 1, ever. Certification