What you're signing when you affirm CMMC compliance

The rule defines the Affirming Official as the senior level representative of the organization who is responsible for ensuring its compliance with the CMMC Program requirements and has the authority to affirm its continuing compliance. It's a named person, not a department. (32 CFR 170.4; 170.22(a)(1))

An Affirming Official from each organization, whether a prime or a subcontractor, affirms the continuing compliance of their own organization. A prime's affirmation doesn't cover its subcontractors, and the other way round. (32 CFR 170.22(a))

Each affirmation includes your name, title and contact information, and a statement that the organization has implemented, and will maintain, all applicable CMMC security requirements for its CMMC status, for every information system within the assessment scope. (32 CFR 170.22(a)(2))

"Will maintain" is part of the statement. You are affirming continuing compliance: that the requirements stay in place between assessments, not only that they were in place on the day of the assessment. (32 CFR 170.22(a), (a)(2)(ii))

Affirmations are entered electronically in the Supplier Performance Risk System (SPRS). The Department verifies the affirmation is there to check compliance with the solicitation or contract. (32 CFR 170.22(a), (b))

After every assessment, including a POA&M closeout, and annually after that. For Level 2: on reaching Conditional status, on reaching Final status, every year after the Final CMMC Status Date, and after a POA&M closeout. (32 CFR 170.22(a), (a)(3), (b)(2)–(3))

If the assessment left items on a POA&M, the closeout must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. You affirm again after the closeout. For a self-assessment, the closeout is done the same way as the first one; after a C3PAO assessment, a C3PAO performs it. (32 CFR 170.21(b); 170.22(a)(3)(iv))

The DoD CIO states that an assessment lapses if the annual affirmation is missed. The CMMC contract clause requires a current status at the required level for the life of the contract and the annual affirmation in SPRS. (DoD CIO, About CMMC; DFARS 252.204-7021(d)(1), (d)(3))

Level 2 (Self) status needs a new self-assessment every three years, with results in SPRS. The annual affirmations sit in between, which is why the evidence has to keep up all year. (32 CFR 170.16(a)(1); DoD CIO, About CMMC)

ForgePoint's recommended practice, not a rule: (1) Does the System Security Plan describe what we run today? (2) Is every POA&M item closed, or inside its 180 days? (3) Has the scope changed: new systems, a new cloud service, a new MSP? (4) Is this quarter's evidence on file, and who can show it? (5) Has anything happened that we'd have had to report? If any answer is "not sure", find out before you sign. (ForgePoint practice)