Your CMMC annual affirmation deserves its own deadline, owner and evidence review. A Level 2 assessment can have a three-year cycle while the affirmation needs attention every year. Tracking only the assessment expiration date leaves an avoidable gap in your compliance calendar.
Table of Contents
Start by opening the relevant CMMC record in the Supplier Performance Risk System (SPRS). Identify the assessment type, the systems it covers and the separate expiration fields. Then make sure the person responsible for affirming continuing compliance has both the authority and the information needed to do so.
Current program context: The official CMMC program notice announces the July 13, 2026 suspension of Phase II, formerly scheduled for November 10, 2026, while retaining Phase I self-assessment requirements. Use current procurement documents and program instructions when deciding what applies to your organization. Do not turn the former phase date into a universal renewal deadline.
Evidence note: This article reviews public documentation. It does not claim a live SPRS test, a completed assessment or an assessor’s approval. The review workflow and worksheet below are editorial planning aids.
1. Separate CMMC annual affirmation from assessment renewal
The first check is a calendar check. The official program overview distinguishes an annual Level 1 self-assessment from a Level 2 self-assessment every three years with annual affirmation. Build your calendar around the applicable record, rather than the anniversary of buying compliance software or finishing a consultant’s readiness review.
| Situation | What to distinguish | Useful internal check |
|---|---|---|
| Level 1 Self | Annual assessment and affirmation | Has the annual assessment actually been completed? |
| Final Level 2 Self | Three-year assessment cycle and annual affirmation | Are both expiration fields still current? |
| Conditional Level 2 Self | POA&M closeout and required affirmation | Is the closeout path progressing within its own deadline? |
For Conditional Level 2 Self, section 170.16 requires remediation, closeout self-assessment and posting of compliance results within 180 days of the relevant Conditional status date. A routine annual review does not replace that process. Use the CMMC POA&M requirements guide when closeout work is involved.
2. Find the SPRS record for your CMMC annual affirmation
Ask your team to identify exactly what it means by “our SPRS score.” The official SPRS Awardee/Contractor User Guide describes separate NIST SP 800-171 and CMMC assessment areas. A screenshot of a NIST assessment summary alone does not establish that the relevant CMMC affirmation workflow has been completed.
For your working record, capture the CMMC assessment identifier, status type, associated organization information and scope description. Reconcile them with the contract or subcontract you are reviewing. Keep unresolved mismatches visible instead of assuming that one valid-looking record covers every environment.
A practical review question is: “Can our contracts lead and security lead point to the same record and explain which work it supports?” If their answers differ, resolve the mismatch before the official reviews an affirmation statement.
3. Prepare the right Affirming Official
Section 170.22 identifies the Affirming Official as a senior representative within the organization with responsibility for compliance and authority to affirm it. Portal access and signing authority are separate questions. A person who maintains the spreadsheet may be well placed to prepare the review package without being the person who should make the affirmation.
Prepare the CMMC annual affirmation review with a short briefing containing the scope, applicable status, known issues and evidence references. Give the official a way to ask questions directly of control owners. An unexplained green dashboard is a poor substitute for a reviewable basis for the statement.
As an internal continuity measure, record who coordinates the process when the usual official is unavailable. Follow your organization’s authority and access processes for any replacement. Avoid leaving account access and appointment decisions until the deadline week.
4. Recheck what changed in the assessed environment
Before your CMMC annual affirmation, compare the environment you operate today with the environment described by the assessment. Useful prompts include a new cloud service, a changed CUI workflow, a replacement managed service provider, remote access changes or a new location handling contract information.
These prompts are a recommended review method, not a claim that every routine change automatically demands a new assessment. Ask whether the change affects the recorded scope, the evidence or the ability to support continuing compliance. Route uncertain cases through the appropriate program, contracting or assessment channel.
For example, consider a hypothetical manufacturer that adds a shared engineering workspace after its assessment. The review should establish whether relevant contract data enters the workspace and whether the existing scope description still represents reality. The software purchase date itself answers neither question.
Use the CMMC scoping guide to organize the boundary questions before updating your internal records.
5. Give the affirmation an evidence review
A CMMC annual affirmation should have a supportable basis. As an editorial workflow, ask each relevant owner for recent evidence, an explanation of important changes and any known implementation issue. This does not replace the assessment methodology or reduce the applicable requirements to a sample.
| Review prompt | Possible supporting record | Question for the owner |
|---|---|---|
| Access remains controlled | Access-review record and resolved exceptions | Were departures and privilege changes handled? |
| Responsibilities remain understood | Current responsibility matrix and service scope | Who performs and evidences each retained task? |
| Changes are understood | Change log linked to boundary and control reviews | Does the documentation describe today’s environment? |
| Known issues are visible | Issue log, owner and disposition | Does any unresolved issue affect the statement? |
Keep facts and judgments separate. “The provider delivered a report” is an observation; “the report demonstrates this requirement across our scope” is a conclusion that needs a reason. Record the reasoning so the official can challenge it. The assessment preparation checklist can help structure the supporting evidence package.
6. Resolve access and workflow blockers early
The official SPRS FAQ explains that the SPRS Cyber Vendor User role is needed to enter and edit cyber assessment information. It also provides instructions for a missing affirmation email: the official can review the pending record through the appropriate workflow rather than treating the email as the only route forward.
For Final Level 2 Self records, the user guide describes an annual affirmation window beginning 60 days before expiration. It says users must track expiration themselves and that notifications are not sent. An expired affirmation is displayed separately from an expired assessment status. Check the live record and current guide before choosing a recovery action.
If a control is missing, first distinguish an access problem, a record-status issue and a timing issue. Record the precise symptom for support. Do not delete or recreate a record simply to make the screen look current.
7. Keep a completion record and a follow-up date
After the authorized official completes the CMMC annual affirmation workflow, inspect the resulting record rather than relying on the button click. Preserve the appropriate confirmation or internal reference, who completed the action and which record was reviewed.
For internal planning, set reminders at 90, 60 and 30 days before the displayed deadline. These are suggested preparation intervals, not official filing deadlines. The earlier check allows time for access repair, owner questions and changes that deserve more investigation.
In a hypothetical Level 2 review, the assessment expiration might still be years away while the affirmation expires next month. The useful response is to review continuing compliance, authority and the correct affirmation workflow now. Waiting for the later assessment date misses the earlier obligation.
Copy this CMMC annual affirmation working record
Store this worksheet with your controlled compliance records. Replace every blank with a fact or an explicitly unresolved question. It is an internal planning template, not an official SPRS submission form.
Organization / internal review owner: Contract or subcontract reference: Applicable CMMC record type and identifier: Assessment scope / relevant systems: Associated CAGE codes checked by: Displayed assessment status and expiration: Displayed affirmation expiration, including timezone: Affirming Official / authority confirmed by: Access checked on: Changes since the previous review: Evidence index / control-owner review references: Known issues / disposition / decision owner: Conditional-status closeout action, if applicable: Questions requiring official clarification: Official's review completed on: Submission result / retained confirmation reference: Next internal review date and owner:
A practical CMMC annual affirmation review meeting
The following meeting format is an editorial example for organizing the work. It does not prescribe an official duration, evidence sample or approval chain. Adapt it to the size of the environment and the issues your team actually finds. A small organization may combine roles, but it should still make each responsibility explicit.
Before the meeting, the coordinator circulates the record identifier, the displayed dates and a short list of changes. Each control owner checks their assigned evidence references and flags anything that no longer reflects the environment. The contracts lead identifies the procurement document being supported. The official receives questions early enough to request clarification instead of making a rushed decision.
Begin by agreeing on the boundary. Ask whether everyone is discussing the same enclave, systems and organization. Resolve different names for the same environment, and identify separate environments that have accidentally been grouped together. Put the agreed description in the working record so the next reviewer can understand the decision without reconstructing the conversation.
Next, review changes and unresolved issues. Give each issue an owner and a concrete next action. Replace vague entries such as “provider to fix” with a question the provider can answer and a record someone can inspect. An action remains open until its result has been reviewed; the existence of a ticket alone does not explain what happened.
Finish by distinguishing preparation from submission. A complete meeting packet can still contain unresolved questions. The coordinator should record what was reviewed, what needs more work and who will decide the next step. The Affirming Official makes the applicable affirmation only when the statement is supportable. The meeting notes should accurately describe that outcome.
Example: repair a weak review handoff
Imagine a small supplier preparing its CMMC annual affirmation review. Its spreadsheet says the assessment expires in two years. The employee who previously coordinated compliance has left, a cloud service has changed and the current manager has only a screenshot showing a score. These are fictional facts chosen to illustrate the review process, not findings about a real contractor.
The first useful action is to assemble the actual records. The coordinator locates the applicable CMMC entry, records its separate affirmation date and asks the contracts lead to identify the relevant requirement. That step converts a general concern about “renewal” into a specific record, deadline and question. It also prevents the team from treating the old screenshot as a complete status report.
The security owner then explains the cloud change in terms of information flows and responsibilities. The review package links to the current boundary description and the evidence supporting the relevant implementation decisions. If a question remains unresolved, it stays visible in the issue log. No one should silently convert uncertainty into a positive status to finish the spreadsheet.
Meanwhile, the organization confirms the responsible official and checks access through its normal process. It records the person who will coordinate follow-up, so the task does not disappear when someone takes leave. The useful deliverable is a traceable handoff: the next person can see what is known, why the team believes it and which decisions still need attention.
Make the next CMMC annual affirmation review easier
After the review, ask which parts took time because information was missing or poorly organized. Common internal friction points include inconsistent system names, evidence references that no longer open, undocumented provider responsibilities and calendars that track only one expiration field. Choose the specific problem your team encountered and improve that step.
For example, if reviewers spent most of the meeting searching for records, maintain a short evidence index with an owner, review date and purpose for each link. If the difficulty was interpreting a change, require a brief boundary-impact note when relevant changes are approved. These are suggested operating practices, not additional CMMC controls created by this article.
Keep the process proportionate. A larger packet is not automatically a stronger packet. A reviewer should be able to follow a requirement to the relevant implementation explanation and supporting evidence without guessing what a filename means. Remove duplicated working copies that cause confusion through your normal records process, while preserving required records and retention obligations.
Use the next internal check to confirm that the improvement worked. Can another authorized reviewer find the same record and understand the outstanding actions? Can the official identify the basis for the statement? Those practical questions help turn CMMC annual affirmation preparation into work the organization can repeat with clear ownership.
CMMC annual affirmation: frequently asked questions
Does a three-year Level 2 assessment mean nothing is due for three years?
No. The annual affirmation has a different cadence. Keep the assessment cycle and affirmation date in separate fields, and review both against the applicable record and contract.
Did the Phase II suspension remove annual self-assessment duties?
The official program notice explicitly retains Phase I self-assessment requirements. Confirm the requirement applicable to your organization instead of treating the suspension as a blanket exemption.
Can our compliance consultant make the affirmation for us?
The rule assigns the affirmation to the organization’s authorized senior representative. Support providers can help prepare evidence and resolve questions; that support does not itself establish the required internal authority.
What should we do if SPRS shows an expired affirmation?
Check the actual record type, assessment status and current compliance before selecting the relevant recovery workflow. Do not assume a later assessment expiration cures the issue. Escalate ambiguous status or access problems through official support and your contracting process.
Is this worksheet enough to demonstrate compliance?
No. It organizes a review. Its value comes from the underlying assessment, current implementation and traceable evidence. Completing every field cannot turn an unsupported claim into a valid affirmation.
Start with the record you actually need to maintain
Make your CMMC annual affirmation review repeatable: open the applicable CMMC record, distinguish its assessment and affirmation dates, and assign the next review to an accountable owner. A small, well-supported review package is easier to maintain than a last-minute search through old screenshots. Keep the evidence current throughout the year so the next official review starts with clear facts.
Primary sources and review limits
- Official CMMC program notice — implementation status; some page access was restricted, with notice text checked in indexed official results.
- Official CMMC overview — assessment and affirmation cadence.
- 32 CFR 170.22 — authority, affirmation content and submission.
- 32 CFR 170.16 — Level 2 Self and conditional closeout.
- SPRS Awardee/Contractor User Guide — version 4.1.5, May 2026, especially printed pages 44–45 for Final Level 2 Self annual affirmation.
- SPRS FAQ — roles and pending-affirmation support.
Sources reviewed October 26, 2026, Korea time. This educational operations guide does not determine any individual contractor’s eligibility. Resolve material compliance decisions using current official instructions and the applicable procurement documents.