How often does a CMMC Level 2 self-assessment have to be affirmed?

Annually, and after each assessment. Under 32 CFR 170.22 the Affirming Official affirms continuing compliance in SPRS after each assessment and annually thereafter, and the DoD CIO notes the assessment lapses if the annual affirmation is missed. The self-assessment itself is repeated every three years.

How is my calendar dated?

Month 12 is the month your annual affirmation is due; Month 1 is eleven months before it. Each task lands in the program month shown, and the calendar file puts it on the first weekday of that month so it shows up early. Months already past are left out of the calendar file.

Which tasks are actually required?

The rows marked Required come from 32 CFR Part 170 or DFARS 252.204-7012: the annual affirmation, the three-yearly self-assessment, the 180-day POA&M closeout if you hold Conditional status, reporting a cyber incident to DoD within 72 hours of discovery, and preserving images and data for at least 90 days after a report. Most NIST SP 800-171 requirements leave the frequency to you; the cadence shown for those is our recommendation, and whatever you choose belongs in your SSP.

Does the calendar work with Outlook or Google Calendar?

Yes. The calendar file (.ics) is a standard iCalendar file with one all-day event per task; Outlook, Google Calendar and Apple Calendar can all import it. The Excel workbook has a cell for your affirmation month that relabels the grid with real months.

What happens to my details?

Your affirmation month stays in your browser tab; the dates and the calendar file are worked out there, and the PDF is drawn on request and not kept. If you ask for the files, ForgePoint keeps your name, work email, company, the role you pick and the date in its CRM.

Free tool · PDF, calendar file and Excel

A year of Level 2 work, with your dates on it.

Passing a self-assessment is the start. Enter the month your annual affirmation is due and the 12-month calendar turns into real months: the required obligations, the recurring NIST SP 800-171 work behind them, and where each one comes from.

Your dates

When is your next annual affirmation due?

The month of your CMMC Status Date anniversary. Not affirmed yet? Pick the month you're aiming for.

MonthYear

Your dates stay in this browser tab. Nothing is sent unless you ask for the files below.

The 12 months, Month 1 to Month 12

Required NIST, cadence recommended Recommended practice

Pick your affirmation month above and every month gets its real name.

Month 1
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
Month 2
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Security awareness and role-based training; keep completion records
Month 3
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Review and update the list of logged event types
- Evidence review: spot-check that evidence is current for a set of requirement families
- Provider check: confirm the MSP and cloud providers still deliver what the shared responsibility matrix and SSP say
Month 4
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Risk assessment of systems that store, process or transmit CUI
Month 5
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
Month 6
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Review and update the list of logged event types
- Incident response test (tabletop exercise), including the 72-hour DoD reporting step
- Evidence review: spot-check that evidence is current for a set of requirement families
- Provider check: confirm the MSP and cloud providers still deliver what the shared responsibility matrix and SSP say
Month 7
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Re-confirm the asset inventory, baseline configurations and the assessment boundary
Month 8
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
Month 9
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Review and update the list of logged event types
- Internal assessment of the security controls against all 110 requirements, with evidence
- Evidence review: spot-check that evidence is current for a set of requirement families
- Provider check: confirm the MSP and cloud providers still deliver what the shared responsibility matrix and SSP say
Month 10
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Update the System Security Plan (SSP) to match the current environment
Month 11
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Pre-affirmation brief: walk the Affirming Official through status, open items and evidence
Month 12
- Annual affirmation of continuing compliance, entered in SPRS by the Affirming Official
- Vulnerability scans, with a remediation record for what was found
- Program steering review: POA&M progress, open risks, control monitoring results
- Review and update the list of logged event types
- Evidence review: spot-check that evidence is current for a set of requirement families
- Provider check: confirm the MSP and cloud providers still deliver what the shared responsibility matrix and SSP say

When it happens, or on a longer cycle

Every 3 years: Level 2 self-assessment against all 110 requirements, results submitted in SPRS
Within 180 days: If you hold Conditional Level 2 (Self): close every POA&M item, run the closeout self-assessment, post results in SPRS and affirm
When it happens: Report a cyber incident affecting covered defense information to DoD through DC3's DCISE reporting portal within 72 hours of discovery
When it happens: After an incident, preserve images of affected systems and relevant monitoring/packet capture data for at least 90 days from the report

What's in it

Every row says why it's there.

Rows are marked as required by the rule or clause, as a NIST SP 800-171 requirement with a cadence we recommend, or as recommended practice.

The obligations with dates attached

Annual affirmation of continuing compliance, entered in SPRS by the Affirming Official (32 CFR 170.16(a)(2); 170.22(a), (b)(2); DoD CIO About CMMC).
Level 2 self-assessment against all 110 requirements, results submitted in SPRS (32 CFR 170.16(a)(1); DoD CIO About CMMC).
If you hold Conditional Level 2 (Self): close every POA&M item, run the closeout self-assessment, post results in SPRS and affirm (32 CFR 170.16(a)(1)(ii)(B); 170.22(a)(3)(iv), (b)(2)).
Report a cyber incident affecting covered defense information to DoD through DC3's DCISE reporting portal within 72 hours of discovery (DFARS 252.204-7012(a), (c)(1)(ii)).
After an incident, preserve images of affected systems and relevant monitoring/packet capture data for at least 90 days from the report (DFARS 252.204-7012(e)).

The recurring work behind them

Monthly vulnerability scans and a program steering review.
Quarterly evidence spot-checks, logged-event reviews and a provider check against your responsibility matrix.
Annual training, risk assessment, incident response test, inventory and boundary check, control assessment and SSP update, in time for the affirmation.
Space for a named owner and an evidence location on every row (Excel).

A planning aid from ForgePoint Cyber, not legal advice, an assessment or a determination of compliance. ForgePoint is a readiness advisor, not a C3PAO. Check obligations against your contracts and the current rule text.

AS OF NOVEMBER 3, 2026 · SOURCE: DoD CIO CMMC program page

Questions

The Level 2 program year, answered

How often does a CMMC Level 2 self-assessment have to be affirmed?: Annually, and after each assessment. Under 32 CFR 170.22 the Affirming Official affirms continuing compliance in SPRS after each assessment and annually thereafter, and the DoD CIO notes the assessment lapses if the annual affirmation is missed. The self-assessment itself is repeated every three years.
How is my calendar dated?: Month 12 is the month your annual affirmation is due; Month 1 is eleven months before it. Each task lands in the program month shown, and the calendar file puts it on the first weekday of that month so it shows up early. Months already past are left out of the calendar file.
Which tasks are actually required?: The rows marked Required come from 32 CFR Part 170 or DFARS 252.204-7012: the annual affirmation, the three-yearly self-assessment, the 180-day POA&M closeout if you hold Conditional status, reporting a cyber incident to DoD within 72 hours of discovery, and preserving images and data for at least 90 days after a report. Most NIST SP 800-171 requirements leave the frequency to you; the cadence shown for those is our recommendation, and whatever you choose belongs in your SSP.
Does the calendar work with Outlook or Google Calendar?: Yes. The calendar file (.ics) is a standard iCalendar file with one all-day event per task; Outlook, Google Calendar and Apple Calendar can all import it. The Excel workbook has a cell for your affirmation month that relabels the grid with real months.
What happens to my details?: Your affirmation month stays in your browser tab; the dates and the calendar file are worked out there, and the PDF is drawn on request and not kept. If you ask for the files, ForgePoint keeps your name, work email, company, the role you pick and the date in its CRM.

Run it with help

Want someone to keep the calendar? That's the Fractional CMMC Program Lead.

Monthly steering, POA&M tracking, quarterly evidence reviews and annual affirmation prep, working alongside your MSP.

See the Fractional CMMC Program Lead →

Starting price

from $7,500/month, 6-month minimum

Microsoft 365 Hardening included, with no separate fee.

Final scope and price are confirmed in a written SOW after discovery.