CMMC is not a one-time assessment followed by silence. The program requires an affirming official to attest to continuing compliance at specified intervals and when relevant status changes occur; DFARS current-status concepts also account for affirmation currency.
For most small defense contractors, the requirement is only as real as the evidence behind it — so the useful test is whether it can be traced to a specific system inside the FCI/CUI boundary, an owner, and a current artifact.
The rule in plain English
For Final Level 1, Final Level 2 Self, and Final Level 2 C3PAO statuses, the rules include annual affirmation expectations tied to continuing compliance. Conditional statuses have their own timing and closeout conditions.
A missed affirmation can therefore create a contracting problem even when the underlying assessment date has not yet aged out.
How to implement it without overbuilding
Calendar affirmations centrally with a named owner and backup. Before signing, verify whether material system or compliance changes occurred and whether the representation remains accurate.
Treat the affirmation as a governance checkpoint, not merely a reminder to click a button in SPRS.
What evidence to keep
Keep the affirmation record, date, affirming official, supporting compliance review, change log, and SPRS confirmation.
Document issues found during the pre-affirmation review and how they affect the status statement.
Where teams get into trouble
A common failure is assigning the task to one employee with no backup. Another is affirming automatically even though the environment materially changed after assessment.
What 'current affirmation' means in the DFARS clause
DFARS 252.204-7021 requires the contractor to complete an affirmation of continuous compliance on an annual basis and maintain it as current in SPRS for each CMMC UID applicable to systems used on the contract. The clause also requires contractors to ensure applicable subcontractors and suppliers complete and maintain their own annual affirmations before subcontract award when the flowed-down CMMC requirement applies.
This is why the affirmation cannot be managed as one company-wide anniversary reminder. A company with multiple CMMC UIDs or assessed systems needs to know which affirmation belongs to which system and which contracts depend on it.
Run a pre-affirmation change review before the official signs
At least several weeks before the due date, review changes since the last assessment or affirmation: boundary changes, new cloud services, acquisitions, new sites, MSP/MSSP changes, privileged-access redesign, unresolved incidents, major findings, and control exceptions. The affirming official should receive a short evidence-backed statement of whether the organization continues to implement the requirements for the relevant system.
If the review finds a material compliance problem, do not solve the calendar by signing first and investigating later. Escalate the issue, determine its effect on the represented status, remediate or obtain appropriate legal/contracts guidance, and keep a record of the decision.
- CMMC UID and assessment/status date.
- Last affirmation date and next due date.
- Material changes since the last affirmation.
- Open deficiencies, exceptions, or scope changes.
- Named affirming official and backup owner.
What happens when the affirmation becomes stale
A stale affirmation can make a CMMC status unusable for the contracting action even if the underlying assessment has not reached the end of its normal validity period. DFARS 252.204-7021 ties contract performance and award mechanics to current status and annual affirmation. That makes missed dates a contract-eligibility and administration problem, not merely an internal-compliance KPI.
After a missed date, verify the SPRS record and the affected solicitations, contracts, options, and subcontracts before making representations. Restore the affirmation only after the organization has a supportable basis for continuous-compliance language. Then fix the process failure—calendar ownership, backup owner, change-review workflow, or system-to-CMMC-UID mapping—so the next cycle does not depend on one person's inbox.
Build the affirmation calendar from CMMC UIDs, not from one corporate date
Create one row per CMMC UID with the related information system, contracts, assessment type, CMMC Status Date, last affirmation date, next due date, affirming official, backup owner, and evidence-review start date. A small company may have only one row today, but structuring the register this way prevents confusion when an enclave, acquisition, joint venture, or separate business unit creates another assessed system.
Link the register to contract administration. Before an option exercise, new award, or subcontract action that depends on CMMC status, check both the status and affirmation currency. This turns affirmation from a once-a-year compliance reminder into a normal contracting control.
- CMMC UID and system name.
- Contracts/subcontracts that depend on that UID.
- Assessment/status date.
- Last and next affirmation dates.
- Affirming official plus backup.
- Pre-affirmation review start date.
A missed affirmation needs a contract-impact check, not just a late submission
If the due date was missed, identify every active or pending contract, option, delivery order, and subcontract that relies on the affected CMMC UID. Check whether an award, option exercise, invoice certification, or supplier representation occurred while the affirmation was stale. The compliance team should not guess at the consequence or quietly backdate the record; route the facts to contracts leadership and counsel when the contractual impact is uncertain.
After the current affirmation is restored on a supportable basis, preserve the date of the lapse, the reason it occurred, the contracts reviewed, and the corrective action taken. That record gives the affirming official a defensible history at the next annual review and shows that the company treated the lapse as a controlled governance event rather than an administrative nuisance.
Use a pre-affirmation evidence review rather than a calendar-only reminder
Start the annual affirmation review early enough to check material architecture changes, provider changes, open deficiencies, status dates, and the systems/contracts tied to the CMMC UID. The affirming official should receive a concise evidence-backed exception list instead of only an automated 'affirm now' reminder.
If any condition makes the continuous-compliance statement uncertain, escalate before submission and document the resolution.
Before assessment week
- ✓Calendar all due dates.
- ✓Name primary and backup owners.
- ✓Review material changes.
- ✓Confirm continued compliance.
- ✓Submit the affirmation.
- ✓Verify current SPRS status.
Common questions
Who can affirm?
The CMMC rule defines an affirming official role with authority to make the representation for the organization.
Is affirmation the same as reassessment?
No. It is a statement of continuous compliance; assessment and affirmation are separate program actions.
What if the environment changed?
Evaluate whether the change affects compliance or the assessed scope before making the affirmation.
Can a missed affirmation affect award?
Yes. DFARS current-status concepts include affirmation currency, so a stale affirmation can affect whether the status is current for contracting.
What should be re-checked immediately before using this guide for a contract decision?
Re-open the controlling government source, confirm the solicitation or contract language for the specific information system, and verify that the provider or program status cited here has not changed since September 4, 2026.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
