CMMC SPRS Affirmation: Who Can Sign and What the Affirming Official Is Certifying
Under 32 CFR § 170.22, the Affirming Official is defined by responsibility and authority, not by title. A CISO may qualify. So may an owner. A systems administrator who knows the environment best often does not — and neither does your MSP, consultant or C3PAO. What the rule actually requires, and what should sit in front of the signatory first.
CMMC SPRS Affirmation: Who Can Sign and What the Affirming Official Is Certifying Read More »