CMMC Affirming Official: who signs and what it attests

Who should be the CMMC Affirming Official?

A contract or solicitation now requires a CMMC status, and someone has to sign the affirmation in SPRS. Under 32 CFR 170.22(a)(1), the Affirming Official is the senior representative of the organization seeking assessment who is responsible for CMMC compliance and has authority to affirm continuing compliance for that organization. The role belongs to the company itself. The right person is whoever holds real authority over the systems that handle federal contract information or CUI, the budget that funds remediation, and the risk decisions about accepting gaps. That is often a chief executive, a chief operating officer, or a senior officer with signing authority, supported by whoever runs IT and security day to day. Confirm internally who can bind the company to a representation made to the government before you assign the role, and record that decision in writing.

A consultant, managed service provider or implementation partner cannot take this role on the client's behalf. Affirmations are made by each organization for its own continuing compliance, so a prime cannot affirm for a subcontractor, and an outside firm cannot affirm for the company it serves. What the organization owns is the decision to affirm, the accuracy of the statement about every system in scope, and the ongoing obligation to maintain compliance. Outside parties can prepare systems, configurations, policies, system security plans and evidence, and they can help the Affirming Official understand what the statement covers. Ask any partner to show, in its written scope, exactly which artifacts it prepares and which decisions stay with your executive.

Before the first signature, the Affirming Official should walk through the scope boundary with the people who run the environment. Each affirmation covers every system inside the assessment scope, so an official who has not confirmed the asset inventory, the external service providers and the status of open POA&M items is signing a statement they cannot verify. Assign a named deputy for evidence and a calendar owner for the annual affirmation and the three-year assessment cycle. Pair this with the eCFR text of 32 CFR 170.22, which sets out the affirmation's required content. Confirm current timing requirements with your contracting officer and the most recent DoW guidance, because the Phase II schedule has been changed since the rule was published.

What each CMMC affirmation states

An affirmation is a signed statement about conditions that continue after the signature date, not a one-time checkbox. The four parts below are what the signer is vouching for, and each one should be understood before anyone signs. Read them together, because a correct name and an accurate scope do not help if the statement about implementation is untrue.

The signer's identity and contact

Each affirmation names the Affirming Official, their title and contact details. DoD uses these details to know who answers for the organization's status if questions arise. The signer should be a senior representative with real authority over the security program, not a placeholder added to satisfy a form. Confirm that the named person still holds that role on every affirmation date, because a departure or reorganization leaves the stated accountability pointing at someone who no longer owns it.

The implementation statement

The core statement says the organization has implemented, and will maintain, all applicable CMMC requirements for the status it holds. The phrase "will maintain" makes this a forward-looking commitment. Before signing, the Affirming Official should ask the assessment lead or consultant for the current status of each requirement, including any open POA&M items and their closeout dates. Signing on the basis of an assessment from a prior year is a common and avoidable error.

Every system in the assessment scope

The statement covers every system in the assessment scope, not only the enterprise network or the systems the CISO manages day to day. Scope usually includes systems that store, process or transmit CUI, and the security protection assets and external service providers that support them. A system added after the assessment, such as a new collaboration tool or a test environment that holds CUI, falls under the same statement. Ask for a written scope list and compare it against the asset inventory before signing.

The SPRS entry DoD verifies

The affirmation is entered in the Supplier Performance Risk System, where DoD verifies that it was submitted. The SPRS record is the external evidence that the organization has affirmed, so an affirmation that exists only in internal files does not satisfy the requirement. Check that the entry shows the correct status, the correct CMMC UID and the correct date after each submission, and that the record matches what the organization believes it has affirmed.

Ongoing conditions, not a snapshot

Because the signer attests to conditions that continue, the affirmation is tied to later events: annual renewal, closeout of a POA&M, and new systems entering scope. A change in systems, personnel or security controls can make an earlier affirmation inaccurate even when no one has filed a new one. Before signing, the Affirming Official should understand which controls depend on people and processes that may change, and who will notify them when that happens.

When the CMMC affirmation is due, from Conditional status to annual renewal

This sequence shows each point where an Affirming Official must sign an affirmation in SPRS, from the first Conditional status through the three-year reassessment, so the organization's status never lapses unnoticed.

Name the Affirming Official before any assessment
The organization's senior representative responsible for CMMC compliance is named before the assessment begins. This person must have authority to affirm continuing compliance for the organization, and their name, title and contact details are recorded for every later affirmation. Confirm the role's authority in writing with the leadership team, because the affirmation is only as credible as the person's mandate. The step is complete when the name and contact details are ready for entry into SPRS.
Affirm on achieving Conditional status
When the organization achieves a Conditional status, the Affirming Official enters an affirmation in SPRS. The affirmation states that the organization has implemented and will maintain all applicable CMMC requirements for its status across every system in the assessment scope. Only the organization's own Affirming Official signs for its own status, never for a prime or subcontractor. Confirm with the contracting officer how the Conditional status interacts with current solicitation language before relying on it.
Affirm on achieving Final status
When the organization achieves a Final status, the Affirming Official enters a second affirmation in SPRS. This entry replaces the Conditional position with a Final one and confirms that the requirements for the status are met with evidence in final form. The step is closed when SPRS shows the Final status date and the affirmation submission that DoD can verify. Check the current status dates and entries against the DoW CIO CMMC pages before submission.
Renew the affirmation annually after Final status
After the Final status date, the Affirming Official must affirm continuing compliance in SPRS every year. Each annual affirmation repeats the statement about implementing and maintaining the applicable requirements across the assessment scope. The affirmation must be entered on time, because a missed annual affirmation causes the assessment to lapse. Set an internal reminder well ahead of the anniversary and confirm the exact timing with the contracting officer.
Affirm after a POA&M closeout assessment
When plan of action and milestones items are closed through a closeout assessment, the Affirming Official affirms again in SPRS. This entry confirms that the open items identified in the earlier assessment have been resolved and that the organization continues to meet its status. Keep the closeout evidence in final form, because the assessment only counts requirements that are fully satisfied. The step is complete when the affirmation is posted and the closeout result is visible in SPRS.
Complete a new Level 2 assessment every three years
Every three years, the organization must complete a new Level 2 assessment, either self-assessed or performed by a C3PAO, depending on the level and program requirements in effect. The Affirming Official then affirms continuing compliance in SPRS after that assessment. The new assessment is the trigger for the cycle to restart, so the organization should plan evidence collection well before the due date. Confirm the current assessment requirements and whether self or third-party assessment applies with the contracting officer and the DoW CIO CMMC pages.
Confirm the current schedule before each deadline
Because the Department of War has changed CMMC phase timing in 2026, the dates in any internal calendar should be checked against the latest guidance before each affirmation. Ask the contracting officer which entries apply to each contract, and review the DoW CIO About CMMC page and the eCFR text of 32 CFR Part 170 for any changes. The step is complete when the organization has a written calendar that names each affirmation, its owner and the source used to confirm the date.

Why every prime and subcontractor affirms for itself

Each organization in the chain affirms for itself, and no company can affirm on another company's behalf. Under 32 CFR 170.22, every organization seeking assessment, whether a prime contractor or a subcontractor, needs its own senior Affirming Official who attests to that organization's continuing compliance in SPRS. A prime's affirmation covers the prime's systems and the prime's CMMC UID. It does not cover the subcontractor's environment, and a subcontractor's affirmation does not cover the prime. Each company's status and affirmation stand on their own, so a prime that holds a Final status has not thereby satisfied the requirement for any supplier that handles Federal contract information or CUI for it.

This matters most during flowdown. Under the application to subcontractors rule in 32 CFR 170.23, the level required in a prime contract carries down to the subcontractors that will process, store or transmit that information. A prime cannot sign for a supplier, cannot enter the supplier's UID, and cannot treat a supplier's status as its own. Primes should check each subcontractor's current status in SPRS and ask for the UID, status date and most recent affirmation evidence before work is released, and they should record what they checked. Subcontractors should confirm that their own Affirming Official is named, that their affirmation is current, and that their assessment scope matches the systems that will touch the prime's data.

Confirm two things with each supplier in writing: that the supplier's own Affirming Official has authority to attest for that legal entity, and that the supplier has calendared its annual affirmation and its three-year reassessment. A missed affirmation can lapse the assessment, which then shows up in the supplier's SPRS record, not the prime's. Contracting officers and primes should review that record directly rather than rely on a supplier's verbal assurance. Because the rules and their enforcement schedule have changed, confirm the current affirmation and reassessment requirements with the contracting officer or your C3PAO before relying on any timeline.

Choosing who holds the Affirming Official role

This table compares the four realistic choices for who signs CMMC affirmations in SPRS, with when each fits and what the organization must confirm. Read it as a test of authority: the signer must be a senior representative of the organization being assessed, and an outside firm cannot hold the role.

Option	When it fits	What the organization must confirm
Chief executive or owner	Small and mid-sized companies where the top executive already signs contracts and attests to other regulatory or financial statements	The person has authority to commit the whole company, understands that the affirmation covers every system in assessment scope, and has time to review the evidence before signing
Senior officer with delegated authority (COO or CIO)	Larger organizations where the chief executive delegates compliance decisions to an officer who runs operations or IT	The delegation is written and current, the officer has authority to affirm continuing compliance for the organization, and the chief executive accepts accountability for that authority
CISO or compliance lead	Organizations with a senior security or compliance employee who reports to executive leadership and already owns the System Security Plan and POA&M	The employee is a senior representative with documented authority, not only a day-to-day manager. Confirm the role is named in a board or executive resolution and that the employee can sign in SPRS on the company's behalf
Outside consultant or implementation partner	Never fits as the Affirming Official. Consultants can prepare systems, evidence and the affirmation package for an employee to review	Confirm the consultant's role is limited to preparation and support. The company's own senior representative must make and submit the affirmation, and the consultant cannot sign or log in as that person

Who prepares the evidence and who signs

Your organization owns the controls, the evidence and the decision to affirm. The Affirming Official is the senior representative responsible for CMMC compliance across the organization and has the authority to state that continuing compliance is in place for every system in the assessment scope. That person has to understand what the statement covers before signing, because the affirmation names them personally and is entered in SPRS.

Affirming Official: a senior leader with real authority over the systems in scope, such as a CIO, COO or executive with budget and accountability for security, rather than a delegate who cannot commit the organization.
Control ownership: named owners for each requirement family who can explain how the control operates and who will keep the evidence current.
The decision to affirm: the signer reviews the assessment results, open POA&Ms and the scope before affirming, and should not sign on the strength of a summary alone.
Subcontractor scope: each organization in the chain affirms for itself, so your signer covers only your systems and your statements.
Ongoing duties: the same person or a successor must affirm annually and after any POA&M closeout.

Before signing, confirm that every in-scope system is covered, that evidence exists in final form, and that the signer can answer questions from an assessor or contracting officer.

What lapses if an annual affirmation is missed

A missed affirmation does more than leave a filing undone. Under 32 CFR 170.22, the assessment itself lapses if the annual affirmation is not made, so the status tied to that assessment is lost with it. The affirmation is the link that keeps a Level 2 result alive between assessments. After each new Level 2 assessment, self or C3PAO, a senior Affirming Official must affirm continuing compliance in SPRS, and that affirmation must be repeated every year after. Under 32 CFR 170.16 and 170.17, the full assessment itself must be repeated every three years, so the annual affirmation is the step that carries a status from one full assessment to the next.

Treat the affirmation dates as hard deadlines. Put the Final status date, each anniversary of it, and any POA&M closeout assessment on the compliance calendar, with reminders well ahead of each date. Name a backup signer who holds the same authority as the primary Affirming Official, is senior enough to affirm for the whole organization, and can log into SPRS. Confirm that the backup's name, title and contact details are current, because each affirmation must state them. A single departure or leave period should not stop the filing.

Ask your contracting officer, in writing, how a lapse would affect contract eligibility under DFARS 252.204-7021, including whether a lapsed status could be treated as a failure to maintain the status the contract requires, and what cure period, if any, applies. Also confirm how the current Phase I and suspension status of the program affects these obligations, since the Department of War has said self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Your answer should be documented before a date is missed, not after.

Why Level 3 contractors affirm twice every year

A contractor pursuing Level 3 does not make one annual affirmation. Under 32 CFR 170.22(b)(4), it affirms each year both its Level 2 status, which comes from a C3PAO assessment, and its Level 3 status, which comes from a DCMA DIBCAC assessment. The reason is that the two assessors check different requirements. The C3PAO evaluates the Level 2 requirements, while DIBCAC evaluates the additional requirements that Level 3 adds, so a single status cannot stand in for the other. Level 3 itself is the top tier and applies only to programs that require it, so the first step is to confirm with the contracting officer whether the solicitation or contract actually calls for Level 3 and which status must appear in the Level 3 affirmation.

Because both statuses must be affirmed, the organization needs to decide who signs. One Affirming Official may cover both statuses if that person is the senior representative responsible for CMMC compliance across the organization and has authority to affirm continuing compliance for both. Alternatively, the organization may assign separate signers, but each affirmation must still identify the Affirming Official's name, title and contact information and must describe the status it covers. Whichever structure is chosen, the affirmations must be entered in SPRS and tied to the correct CMMC UIDs and status dates, and the two Level 2 and Level 3 statuses should be tracked on separate calendars so that neither one lapses unnoticed.

Where affirmations go wrong and how to avoid it

Most affirmation failures are not technical. They come from signing too early, signing without authority, or treating a suspended phase as a pause on every obligation. The cards below pair each pitfall with a control your organization can put in place before the Affirming Official signs.

Signing before evidence is final

A requirement counts as met only when every applicable assessment objective in NIST SP 800-171A is satisfied with evidence in final form, not drafts. An Affirming Official who signs while policies, scan reports or configuration baselines are still in review is affirming something the assessment record does not support. Before signing, have the assessment lead confirm in writing that each in-scope requirement points to approved, dated evidence. Treat any draft as open until it is finalized.

Signer without authority or scope knowledge

The Affirming Official must be the senior representative responsible for CMMC compliance who has authority to affirm continuing compliance for the organization. An executive who cannot name the systems in the assessment scope, the CUI flows or the external service providers is a poor signer, even if the title is senior. Ask the proposed signer to walk through the system boundary and the affirmation statement before the first submission. Record the name, title and contact details exactly as they will appear in SPRS.

Affirming for a subcontractor or consultant

Each organization in the chain, prime or subcontractor, must affirm its own continuing compliance in SPRS. A prime cannot affirm on a subcontractor's behalf, and a consultant cannot sign for the client. Where a supplier handles CUI, confirm that its own Affirming Official has made its own submission, and keep a copy of that record in your contract file. Consultants may prepare evidence and explain requirements, but the signature belongs to the organization being assessed.

Missing the annual affirmation date

Affirmations are due at Conditional status, at Final status, annually after the Final status date and after a POA&M closeout assessment. Under the rule, the assessment lapses if the annual affirmation is not made, which can leave a contract without a current status for the contracting officer to rely on. Put every affirmation date on the compliance calendar with two owners, and schedule the signature a few weeks before the deadline so there is time to correct any entry. Review the SPRS record after each submission to confirm DoD shows it.

Reading the suspension as relief

On 13 July 2026 the Department of War suspended CMMC Phase II and started a 60-day review by a CMMC Reform Task Force. The same announcement said Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Some teams have treated the pause as a reason to stop affirming. Confirm the current requirements with the contracting officer and with the DoW CIO page, and keep affirmations on schedule while the review runs.

False Claims Act exposure

The False Claims Act imposes liability on those who knowingly submit false claims to the Government. The CMMC final rule says DoD lacks authority to change that statute, and it declined to address safe harbor requests because they were outside the rule's scope. An inaccurate affirmation can therefore create liability that exists regardless of CMMC. Before signing, have counsel review the affirmation statement, and document how each claim of compliance was verified, including the date and the evidence reviewed.

Questions buyers ask about the Affirming Official

Can a consultant sign the CMMC affirmation for us?

No. The affirmation must be made by the organization's own Affirming Official, the senior representative responsible for CMMC compliance who has authority to affirm continuing compliance for that organization under 32 CFR 170.22(a)(1). An outside consultant or implementation partner can prepare systems, documentation and evidence, and can explain what the statement covers, but the signature and the SPRS entry belong to your company. Confirm the signer's name, title and authority internally before any engagement starts, and make sure the partner's written scope says it will not make affirmations on your behalf.

Does the Affirming Official have to be a C-suite officer?

The rule does not require a C-suite title. It requires a senior representative within the organization who is responsible for CMMC compliance and has authority to affirm continuing compliance for that organization. In practice, that often means an executive or senior manager with budget and decision rights over security. Check your bylaws, delegation-of-authority policy and internal signing rules, because a title that looks senior on paper may not carry the authority the affirmation needs. Document the appointment so an assessor or contracting officer can see who holds the role.

How much effort does an affirmation add beyond the evidence we already prepared?

The affirmation itself is a short statement with the signer's name, title and contact details, plus an attestation that the organization has implemented and will maintain all applicable requirements across every system in scope. The real effort sits upstream: confirming that each requirement is met with evidence in final form, that the system security plan matches what is deployed, and that open plan of action items are tracked. If that evidence is current, the signing step is small. If it is stale or drafted, the affirmation carries the risk. Ask your partner to show which evidence supports each claim before the signer is asked to sign.

What happens if our Affirming Official leaves the company?

The role is tied to a person, so a departure should trigger a formal handover. Your organization should appoint a successor with the same authority, confirm that the SPRS account and contact details are updated, and decide who will make the next required affirmation. Because the affirmation must be made on a schedule, including annually after the Final status date, a gap in the role can leave the assessment exposed. Build succession into your CMMC governance now, and check with your contracting team whether any notice to the contracting officer is needed.

Is a Conditional affirmation enough to bid on a contract?

Whether a Conditional status is enough to win work depends on the solicitation's CMMC requirement, the requirements that remain open on a plan of action and milestones, and the contracting officer's decision. The Conditional affirmation is required once the Conditional status is achieved, and it is entered in SPRS, but it does not by itself settle eligibility. Read the solicitation's stated level and status, confirm which open requirements can wait on a POA&M, and track the status date. Confirm these points with your contracting officer and your internal bid review, rather than assuming an affirmation alone is sufficient.

Does the Phase II suspension change when we must affirm?

The Department of War suspended CMMC Phase II on 13 July 2026 and started a 60-day review by a CMMC Reform Task Force. The same announcement states that Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. So the affirmation schedule under 32 CFR 170.22 still applies to organizations that hold a status. Because the review may change timing, check the current Department of War and DoW CIO guidance before you set internal dates, and confirm with your contracting officer which obligations apply to your specific contracts.

What must our organization give the partner before the affirmation is prepared?

Before a partner can help you prepare an affirmation, your organization should provide the named Affirming Official and the scope of systems that handle FCI or CUI, along with the current system security plan, asset inventory, network diagrams, policies, and the evidence for each requirement. You should also share your current assessment results, POA&M items with owners and dates, and any subcontractor or cloud service provider arrangements that affect scope. Your internal owners must confirm each statement is accurate. A written scope should list these inputs and who approves them, so the affirmation rests on your records rather than the partner's summary.

How DeployOpen prepares systems and evidence before the affirmation

DeployOpen works on the technical and documentary groundwork that an Affirming Official relies on before signing. We scope the systems in your CMMC assessment boundary, build and document the controls, and hand over evidence in final form. The organization owns its controls and the affirmation, and an independent assessor or certification body issues any reports or certificates.

How we scope

Agree in writing which systems, users and assets fall inside the CMMC assessment scope before work starts.
Confirm the Affirming Official's named role, title and contact details so the affirmation content is settled early.
List every system that handles FCI or CUI, so each one can be covered by the affirmation statement.

How we build

Configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks to meet the Level 2 requirements in scope.
Document the system security plan and plan of action entries that show the current implementation state for each requirement.
Test controls against the NIST SP 800-171A objectives so gaps are found before the Affirming Official relies on them.

How we hand over

Deliver evidence in final form, not drafts, mapped to each requirement ID and assessment objective in the agreed scope.
Walk the Affirming Official and compliance lead through what each affirmation statement covers and which evidence supports it.
Provide a handover record listing dates, owners and review points for the next annual affirmation.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after the handover.
Review evidence and configuration changes before each annual affirmation and after any POA&M closeout assessment.
Ask your independent assessor or C3PAO to confirm the results, since DeployOpen prepares evidence but does not issue reports or certificates.

The CMMC Affirming Official: who signs and what they attest