If your company holds a Department of War (DoD) contract that requires CMMC Level 1, someone at your company makes a statement to the federal government every year. It is called the affirmation, it is entered in the Supplier Performance Risk System (SPRS), and it is the most important part of Level 1 to get right.
This post explains what the affirmation says, who should make it, and how to make sure it is true before anyone clicks "submit".
What the affirmation is
Under the CMMC program rule (32 CFR part 170), a Level 1 company does two things in SPRS each year:
- Enters its self-assessment result. The company checks itself against the 15 safeguarding requirements in FAR 52.204-21 and records the result. For Level 1, every requirement has to be met. Unlike Level 2, a plan of action (POA&M) cannot be used to close a gap later.
- Affirms compliance. A senior official affirms that the company has implemented the requirements and will keep them in place.
The affirmation is made when the self-assessment is completed and then again every year. The contract clause DFARS 252.204-7021 makes a current self-assessment and affirmation a condition of award, so an expired affirmation can cost you a contract.
Who should affirm
The rule calls this person the Affirming Official: a senior-level representative of the company who is responsible for making sure the company meets the requirements and who has the authority to affirm on its behalf.
In a small company that is usually the owner, president or another officer, not the IT contractor and not an office manager entering data on someone else's behalf. Two practical points:
- The person who affirms should understand what they are affirming. If your outside IT provider handles the technical controls, the officer still needs to see the evidence before affirming.
- Write down who it is. If the owner changes or the role moves, the next person needs to know the affirmation is theirs.
Why it matters: an affirmation is a statement to the government
An affirmation is not a formality. It is a representation to the federal government that your company meets specific security requirements. If it isn't true, the company can face liability under the False Claims Act.
The Department of Justice has a Civil Cyber-Fraud Initiative, launched in 2021, which uses the False Claims Act against contractors that misrepresent their cybersecurity compliance. Several companies and universities have paid settlements under it. The point is not to scare anyone off; most small companies can meet Level 1. It is to make sure the affirmation reflects what is actually in place.
CMMC's Phase 2 suspension in July 2026 did not change any of this. The pause applies to third-party Level 2 assessments, not to the Level 1 self-assessment or the annual affirmation.
What "meets the requirements" means in practice
Before the official affirms, there should be a short, honest answer to each of the 15 requirements, plus something that shows it. For a small shop that might look like this:
| Requirement area | What "met" might look like | Evidence to keep |
|---|---|---|
| Only authorized users | Every person has their own login, and former staff are removed | A current user list |
| Outside systems | Rules for personal devices and outside cloud accounts | A short written policy |
| Public information | Someone reviews what goes on the website | A note of who approves posts |
| Passwords and sign-in | Passwords on every account, ideally multi-factor | A screenshot of the settings |
| Old drives and paper | Drives are wiped or shredded before disposal | A disposal log or vendor receipt |
| Physical access | Locked office, visitor log, key and badge tracking | The visitor log |
| Network edge | Firewall on, guest Wi-Fi separate from internal | A router or firewall screenshot |
| Updates and malware | Automatic updates and antivirus on every computer | The console or settings screenshot |
You don't need expensive tools for this. You need to know where each answer lives, so you can show it if a prime contractor or contracting officer asks.
Keeping it true all year
An affirmation says you meet the requirements and will continue to. A few habits keep that true between annual reviews:
- When someone leaves, remove their access the same day.
- When you add a new computer, set up updates and antivirus before it touches company data.
- Keep the visitor log going, even when it feels unnecessary.
- Review once a year, before the affirmation date, and update your evidence.
If something changes and you no longer meet a requirement, fix it promptly. If you cannot, talk to your contracting officer rather than letting the affirmation stand.
A simple affirmation checklist
Before the official affirms in SPRS:
- Confirm the contract or solicitation calls for Level 1 (Self), and which systems handle FCI.
- Walk through all 15 requirements and mark each one met, with its evidence.
- Fix anything that isn't met. There is no partial credit at Level 1.
- Have the Affirming Official review the results and the evidence.
- Enter the self-assessment result and the affirmation in SPRS.
- Put next year's date on the calendar.
How Fix&Affirm helps
Fix&Affirm was built for exactly this moment. It walks through the 15 requirements in plain English, shows how to fix each gap and produces the document pack your official can review before affirming. The assessment is free.
Start your free Level 1 assessment
This article is general information, not legal advice. Check your own contracts and the current rules before you affirm.