It’s Thursday afternoon at an 80-person machine shop that makes parts for a Navy program. The IT manager leans into the president’s office and says the self-assessment is done, the score is in the Supplier Performance Risk System, and all that’s left is for a senior official to affirm it so the bid can go out Friday. It takes ten seconds, he says. Nobody in the room has read the sentence the president is about to put his name under. That sentence is the CMMC affirmation, and with the third-party certification requirement suspended it carries more weight than it did a year ago.
What the CMMC affirmation says
The rule is 32 CFR 170.22, and it is short. Every organization with a CMMC status, prime or subcontractor, must have an Affirming Official affirm continuing compliance after every assessment, after a plan of action is closed out, and every year after that. The affirmation goes into SPRS with the official’s name, title and contact information. It attests that the organization “has implemented and will maintain implementation of all applicable CMMC security requirements” for “all information systems within the relevant CMMC Assessment Scope.”
The rule also says who signs: “the senior level representative from within” the organization who is responsible for its compliance and has the authority to affirm it. Senior means this isn’t a help desk task. Within means it can’t be handed to a consultant or a managed service provider, mine included.
The pause left the affirmation in place
On July 13, 2026, the Department of War suspended CMMC Phase II, which would have brought third-party certification into contracts on November 10. The implementing memo takes Level 2 certification requirements out of solicitations and existing contracts. It also says how the rules are enforced in the meantime: the Department “will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments.”
As of early October, the review hasn’t produced a report or a new timeline. Until it does, what the government holds for most suppliers is a number the company calculated and a senior official’s word that it’s real.
Four things you are attesting to
The scope is honest. Every system that processes, stores or transmits controlled unclassified information has to be inside the boundary you assessed, including cloud services, backups and any AI tool an engineer has pasted a controlled specification into. If nobody has listed those tools, start with a shadow AI inventory.
Met means met, with final evidence. Under the CMMC scoring rule, each of Level 2’s 110 requirements is met only when all of its applicable objectives are satisfied based on evidence in final form. Working papers, drafts and unapproved policies don’t count.
The score is the real score. The score starts at 110 and loses points for every requirement not met, which is how scores go negative. A plan of action is allowed only for certain lower-value requirements, only at a score of 88 or better, and only for 180 days.
It will stay true. “Will maintain” is a promise about next month. The affirmation is due every year, but the promise runs the whole time. A new cloud service, an acquisition or a departed administrator can make it untrue on an ordinary Tuesday.
Why the signature carries legal weight
The score and the affirmation are statements the government relies on: a contract that requires a Level 2 self-assessment can’t be awarded until both are in SPRS. That brings in the False Claims Act, which reaches a company that knows a statement is false and also one that acts in “deliberate ignorance” or “reckless disregard” of the truth. It requires no proof of specific intent to defraud.
The Justice Department has pressed that point since launching its Civil Cyber-Fraud Initiative in October 2021. In its $4.6 million settlement in March 2025, MORSECORP acknowledged that it had reported a score of 104, that a third-party consultant told it in July 2022 the real score was negative 142, and that it didn’t update the number until June 2023, three months after a subpoena. On September 1, 2026, seven weeks into the pause, Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that it failed to comply with NIST SP 800-171 on a Defense Department contract.
Five things to see before you affirm
None of this is a reason not to sign. It’s a reason to sign the way you sign a financial statement: after seeing the work. Ask for five things.
- The boundary: a diagram and asset inventory showing where controlled information enters, lives and leaves.
- The System Security Plan, dated and current, describing how each requirement is met in your environment, not in a template.
- The scoring worksheet, with final evidence behind every requirement marked met, reviewed by someone other than its author.
- The plan of action, with an owner and a date on every open item.
- The change list: new systems, vendors, administrators and incidents since the last affirmation.
Then ask who outside the team has checked it. Voluntary C3PAO assessments remain available during the pause. In July 2026, a defense consulting firm my team prepared met all 110 requirements at its C3PAO Level 2 assessment after about 90 days of work. It got there with a tight boundary, every requirement documented the way an assessor tests it, and an evidence walk-through rehearsed until nothing in it was a surprise.
Frequently asked questions
Who can sign a CMMC affirmation?
The Affirming Official: under 32 CFR 170.22, the senior-level representative from within the organization who is responsible for its CMMC compliance and has the authority to affirm it. A consultant or managed service provider can prepare the evidence but can’t sign.
How often is a CMMC affirmation required?
After every assessment, after a plan of action is closed out, and annually after that. Level 1 requires a self-assessment and an affirmation every year. Level 2 requires a self-assessment every three years and an affirmation every year. All of it is entered in SPRS.
Did the CMMC Phase II pause remove the affirmation?
No. The July 13, 2026 suspension took third-party certification requirements out of solicitations and contracts. Level 1 and Level 2 self-assessments and their annual affirmations remain, along with DFARS 252.204-7012 and NIST SP 800-171 Revision 2.
My team at Stealth Technology Group, a Cyber AB Registered Practitioner Organization, prepares defense suppliers for this signature through our CMMC readiness work. If you want to walk through what’s behind your own score before the next affirmation is due, get in touch.