The affirmation isn’t paperwork. Read what it commits you to.

Most contractors approach affirmation in the wrong order. Security completes the assessment. Someone calculates the score. Contracts or compliance enters the result into SPRS. Then, near the end of the process, somebody asks who should sign the affirmation.

That is backwards.

The Affirming Official should be identified before the assessment starts, because the assessment is producing the evidence that allows that individual to make a defensible statement to the government. This is not an approval workflow.

Under 32 CFR § 170.22, a named senior-level representative from within the organization affirms continuing compliance with the applicable CMMC requirements. The affirmation identifies that individual by name, title and contact information. The organization owns the compliance obligation. The Affirming Official owns the decision to make the affirmation.

Section one

What § 170.22 actually requires

The governing language sits in one short section of the CMMC rule. There are several things I would expect every CISO, compliance lead and executive signatory to understand before an affirmation is submitted.

The Affirming Official is defined by responsibility and authority

The regulation does not say the Affirming Official must be the CISO, CIO, CEO, president or owner. It establishes a functional test. The individual must be a senior-level representative from within the Organization Seeking Assessment, must be responsible for ensuring compliance with CMMC Program requirements, and must have the authority to affirm the organization’s continuing compliance.

That is a governance requirement, not a job-title requirement. A CISO may satisfy it. A CIO may satisfy it. In a smaller defense contractor, the president or owner may be the appropriate person. What matters is whether the individual genuinely holds the responsibility and authority described by the rule.

That is also why I would be cautious about assigning the role to the person who knows the technical environment best. A systems administrator may understand every firewall rule, endpoint configuration and enclave boundary in the company and still not have the organizational authority to make the affirmation.

The same issue applies to outside providers. Your MSP, MSSP, consultant or C3PAO can supply evidence, technical advice and assessment results. None of them substitutes for the internal senior-level representative the rule requires.

The responsibility also does not move through the supply chain. A prime affirms for the prime. A subcontractor affirms for itself. Each Organization Seeking Assessment carries its own.

The statement is broader than “our SPRS score was correct”

This is the part of § 170.22 that deserves more attention than it normally receives. The required affirmation states that the organization has implemented and will maintain implementation of all applicable CMMC security requirements for its CMMC Status, across the information systems within the relevant CMMC Assessment Scope.

Three assertions live inside that sentence.

That last one changes how a CISO should think about affirmation. You are not confirming that a spreadsheet was accurate on the day somebody calculated the score. You are making an assertion about a living control environment.

And living environments drift. A new SaaS platform starts processing CUI. An administrator creates a file share outside the approved enclave. A privileged account is added without the expected controls. An MFA exception intended to last three days becomes permanent. A subcontractor changes how information is exchanged. A security tool stops reporting. A system previously considered out of scope becomes connected to an in-scope workflow.

None of those events waits for your next annual assessment.

So the operational question is not whether the environment was compliant when you assessed it. It is whether you have enough change control, asset governance, evidence and executive oversight to know when the statement you affirmed is no longer supportable. That is a considerably higher standard than completing an annual compliance exercise.

Affirmation is event-driven as well as annual

Organizations often reduce the requirement to “we have to affirm once a year.” That is incomplete. Affirmation is required upon achieving Conditional CMMC Status, upon achieving Final CMMC Status, annually following the Final CMMC Status Date, and following a POA&M closeout assessment where applicable.

Your compliance calendar should therefore follow your CMMC status dates and assessment events — not your fiscal year, insurance renewal, contract anniversary, or whatever month your organization traditionally runs its annual security review. The Final CMMC Status Date matters. So does POA&M closeout. Those dates belong in a calendar with accountable owners and escalation before expiration, not in somebody’s inbox.

Every organization affirms for itself

This matters particularly in complex corporate structures, shared-service environments and prime/subcontractor relationships. Several legal entities may use the same Microsoft 365 tenant. They may share a security team, a SOC, an MSP, a SIEM, an identity provider and network infrastructure.

None of that makes their CMMC responsibilities interchangeable. The legal entity, contracts, CUI flows, assessment scope, information systems and CMMC status still have to line up with what is being affirmed.

Shared infrastructure can simplify operations. It can also make scope considerably harder to defend. This is one of the areas where I would want architecture, contracts, security and compliance looking at the same diagram before an executive signs anything.

Section two

Cadence by assessment level

There is an additional point organizations pursuing Level 3 need to understand. The Level 3 affirmation does not eliminate the Level 2 affirmation. The rule requires the organization to maintain the applicable annual Level 2 (C3PAO) affirmation as well, because the C3PAO and DCMA DIBCAC assessments address different requirement sets.

Higher maturity does not erase the lower assessment record. Both matter.

Section three

What I would require before an executive signs

The regulation tells you who must affirm and what must be affirmed. It does not design your internal executive assurance process for you. That is the organization’s job.

If I were accountable for the security program, I would not put an affirmation in front of a senior executive with nothing more than an SPRS score and an email asking for approval. The executive should receive an affirmation package — not a 300-page evidence dump, but a concise management package explaining what the organization is about to represent and why management believes that representation is supportable.

The purpose is not to manufacture paperwork around the executive. It is to establish a decision record.

If the affirmation is questioned eighteen months later, an email saying “please approve” will not tell the story. A useful record shows what the organization knew, what it tested, what had changed, what remained open, who reviewed those facts, and why management concluded the affirmation was supportable.

The signature does not transfer security’s responsibility

Because a senior executive signs, security teams sometimes start talking as though the executive has now “accepted the risk” and everyone underneath is protected. That is the wrong model.

The Affirming Official depends on representations coming from system owners, security personnel, compliance staff, service providers and business leadership. If those representations are incomplete or unsupported, an executive signature does not cure the underlying problem. The signatory needs reasonable assurance. The security organization has to produce it.

Section four

SPRS access is part of the control

There is also a very ordinary way for an otherwise mature process to fail: the right executive cannot access SPRS when the affirmation is due.

I would treat that as an identity and continuity issue, not an administrative inconvenience. The Affirming Official needs PIEE access with the appropriate SPRS role, established and tested well before the deadline. The account belongs to the individual, not the company. If that person leaves, retires, changes roles or no longer holds the necessary authority, the organization needs a succession process — designed in advance, not discovered during a departure.

At minimum, maintain a documented role owner, successor, required system access, affirmation dates and escalation path.

The same principle applies to the security team. If only one employee knows how the assessment was calculated, where the evidence is stored, or why certain assets were classified a particular way, you do not have a sustainable compliance process. You have key-person dependency.

Section five

What the False Claims Act changes about the conversation

Cybersecurity obligations in federal contracts do not exist separately from federal enforcement law. 18 U.S.C. § 1001 addresses materially false statements made knowingly and willfully in matters within federal jurisdiction. The False Claims Act creates a separate civil framework where its statutory elements — including falsity, knowledge and materiality — are satisfied.

Those distinctions matter, and they cut in the contractor’s favour as often as against. A failed security control does not automatically equal fraud. An inaccurate assessment does not automatically establish False Claims Act liability. A cybersecurity deficiency does not, by itself, prove that an Affirming Official committed a criminal offense. I would be careful about overstating that connection.

But organizations should be equally careful about assuming the opposite. The Department of Justice’s Civil Cyber-Fraud Initiative specifically targets knowing cybersecurity noncompliance, misrepresentation of cybersecurity practices, and related failures involving government contractors and recipients of federal funds.

The enforcement history is now significant enough that evidence integrity belongs in your compliance architecture. The question is no longer only whether you implemented the control. It is also what you represented about that control, what evidence supported that representation, what you knew when you made it, and what happened afterward.

What recent enforcement should teach a CISO

The lesson is not that every security deficiency creates FCA liability. That would be wrong. The more useful lesson is that the government can examine the distance between what an organization represented and what its own records show it knew about the environment.

Which means internal security records, assessments, SSPs, tickets, risk decisions, POA&Ms and executive representations need to tell a coherent story.

• If the SSP says MFA is enforced but an internal ticket says MFA was disabled six months ago with no remediation date, you have more than a documentation problem.
• If the assessment says a requirement is implemented but the control owner says the evidence came from a decommissioned system, you have more than an evidence problem.
• If the SPRS score assumes one CUI boundary but engineering has been moving CUI through systems outside it, you have more than a scoping problem.

You have conflicting organizational representations. That is what should concern a CISO.

Section six

External providers, M&A, and the C3PAO question

External providers do not remove the obligation

Modern defense contractors depend heavily on external providers. MSPs, MSSPs, cloud platforms, SaaS applications and specialized security providers may operate significant parts of the technical environment. That can be entirely appropriate.

But outsourcing the technology does not outsource the contractual representation. If a provider participates in the storage, processing, protection or transmission of CUI, or provides security functions supporting the environment, understand exactly how that relationship affects scope, responsibility and evidence.

Do not accept “our MSP handles that.” Ask which requirement, which system, who operates it, who configures it, who monitors it, where the evidence lives, what the contract obliges the provider to do, what happens when the provider changes the service — and who tells you when it does.

A third party can operate the control. Your organization still has to understand what it is representing about that control.

M&A diligence now needs a CMMC history

If you are acquiring a defense contractor, do not stop at “are you CMMC compliant?” That question is almost useless by itself.

Ask for the history. Prior SPRS scores. SSP versions. Assessment results. POA&Ms. Material security incidents. CUI scoping decisions. Known exceptions. Prior representations to contracting officers and prime contractors. What management knew when those representations were made — compared against the environment you are actually acquiring.

A change in ownership does not make the historical record irrelevant. The better diligence question is whether the target’s evidence supports the representations it has already made to the government and its customers.

A C3PAO assessment is evidence — not a liability shield

An independent C3PAO assessment provides valuable assurance. A qualified external assessment organization has examined the applicable environment against the relevant requirements and reached a result. That matters.

But it is not immunity. The organization still owns the accuracy of the information supplied to the assessor. It owns systems or CUI flows omitted from scope. It owns material changes after the assessment. It owns control degradation that occurs afterward. And the Affirming Official still carries a separate responsibility under § 170.22.

So I would not brief an executive with “the C3PAO certified us, so you can sign.” I would brief them this way: the independent assessment is one important source of assurance; here is what has changed since, here are the current open items, here is the evidence supporting our present position, and here is why management believes the affirmation remains supportable.

Section seven

What the Phase 2 suspension actually changes

The September 2026 environment requires precision. On 13 July 2026 the Department suspended advancement to CMMC Phase 2, which had been scheduled to begin on 10 November 2026 and would have expanded the use of Level 2 (C3PAO) certification requirements. Class Deviation 2026-O0025, Revision 3, signed 3 September 2026, carried that direction into the acquisition framework used by contracting officers.

The mistake is reading that as “CMMC is paused, so we can stop.” That is not a security strategy.

Separate the assessment mechanism from the underlying security obligation. The pause affects advancement into Phase 2 third-party requirements. It does not erase the safeguarding obligations that continue to apply under applicable DoD contract clauses, including DFARS 252.204-7012 and the applicable NIST SP 800-171 Rev. 2 requirements for covered contractor information systems.

That distinction should affect budget decisions. If an external C3PAO assessment is no longer immediately required by the acquisition path in front of you, reconsidering the timing of that assessment spend is reasonable. Stopping implementation or operation of the controls is not.

Identity management still has to work. CUI still has to be protected. Incident response still has to function. The SSP still has to describe reality. Scope still has to make sense. Suppliers still need governance. Evidence still needs to exist.

One DFARS numbering issue worth cleaning up

The 2026 acquisition changes have created a documentation problem inside many compliance programs. Under the applicable 2026 class-deviation framework, the NIST SP 800-171 DoD Assessment Requirements language appears at DFARS 252.240-7997. Many existing policies, procedures, compliance matrices and contract reviews still reference DFARS 252.204-7020.

Do not blindly find-and-replace. Your internal documentation should identify which authority and version applies. Class deviations and codified acquisition regulations do not necessarily move on the same timetable, and good compliance documentation preserves that distinction rather than hiding it.

Section eight

What I would do before the next affirmation

The question I would ask before signing

Not “did we complete the assessment?” Not “is there a score in SPRS?” And not “did the consultant say we’re good?”

If the answer is yes, the affirmation is the final step in a functioning assurance process.

If the answer is “probably,” “mostly,” or “the consultant handled that,” you are not dealing with an SPRS problem. You are dealing with a governance problem. And that is exactly why the Affirming Official requirement matters.

References

FAQ

Common questions

This brief reflects published guidance as of 15 September 2026. Class Deviation 2026-O0025 has been revised three times since issuance and remains in effect until rescinded or incorporated into the FAR, DFARS and DFARS PGI — verify the current revision before relying on it. CMMC Level 2 is assessed against NIST SP 800-171 Rev. 2. Advisory content, not legal advice. Affirmation, disclosure and contract-specific decisions should be evaluated with qualified counsel against the applicable solicitation, contract clauses, amendments, modifications and current Government guidance.

Nabiha Sofia Herradi

PRINCIPAL · CYBER DSC

Sofia advises defense contractors on CMMC readiness and NIST SP 800-171 implementation — reading DFARS 252.204-7012 the way an assessor reads it, then checking whether the control is actually implemented the way the document claims. She holds a law degree and a networking background, along with CMMC-CCP, CISA, CISM, CIPP/E and CIPP/US.

Cyber DSC · Insights · CMMC Regulatory Brief 02 · 15 Sep 2026