A CMMC assessment is not the end of the paperwork. Under 32 CFR 170.22, a named senior leader at your company affirms, in SPRS, that you meet your CMMC level and will keep meeting it. Here is what that affirmation says and when it is due.
Who signs
The Affirming Official is the senior-level representative within your company who is responsible for ensuring compliance with CMMC requirements and has the authority to affirm your continuing compliance. Primes and subcontractors each have their own.
What the affirmation says
Each affirmation includes:
- The Affirming Official's name, title and contact information- A statement that your company has implemented, and will maintain, all applicable CMMC security requirements for its CMMC status, for every information system in the assessment scopeAffirmations are entered in SPRS, and DoD checks SPRS for them. ## When it is due
- When you achieve a Conditional CMMC status, if applicable- When you achieve a Final CMMC status- Every year after the Final status date- After a POA&M closeout assessmentDFARS 252.204-7021 adds that the affirmation must be completed every year and kept current. It defines a current affirmation as no older than 1 year, with no changes in compliance since. Primes must make sure their subcontractors complete an affirmation before subcontract award and maintain it every year. ## Before you sign
- Re-score every requirement for your level against how your systems run today.- Check that you have evidence for each requirement you claim.- Update your SSP so it matches what you have.- If something changed, fix it or reassess before you affirm.CMMC Phase 2 is suspended, but Level 1 (Self) and Level 2 (Self) requirements, including affirmations, remain in place. ## Start here Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance firm in Orlando, Florida. We help your Affirming Official sign with confidence: https://cyberneza.com/cmmc Sources: 32 CFR 170.22, 32 CFR 170.4, DFARS 252.204-7021
Top comments (0)