The DFARS rule that put CMMC into defense contracts took effect on November 10, 2025, and a company that posted its first self-assessment in the weeks that followed now faces a renewal date most programs never put on a calendar. The regulation does not treat an affirmation as a one-time signature. It treats it as an annual statement, and the first anniversary arrives next week.
This is a follow-up. An earlier issue covered what the affirming official is personally on the hook for, and Issue 35 covered the class deviation that paused third-party assessment while keeping self-assessment and the annual affirmation in place. What has changed since is only the calendar, and the calendar is where programs slip.
Does the Phase 2 pause change any of this?
No. The July 13 suspension stopped the move to third-party assessment, and the September 3 revision of class deviation 2026-O0025 carried that pause into contracting officers' instructions. As Issue 35 laid out, the same deviation left Level 1 (Self) and Level 2 (Self) in place, with a current score in SPRS and an annual affirmation. 32 CFR part 170, the program rule, is untouched. With the C3PAO path paused, the self-assessment and its affirmation are the whole of a small contractor's CMMC record.
What exactly is due each year?
32 CFR 170.22(a) says an affirming official must affirm continuing compliance "after every assessment, including POA&M closeout, and annually thereafter." Affirmations "are entered electronically in SPRS," and the rule says the Department "will verify submission of the affirmation in SPRS."
The two self-assessment levels then part ways. For Level 1, 170.15 requires the self-assessment itself "on an annual basis," with results submitted to SPRS, and 170.22(b)(1) requires an affirmation "at the completion of a Level 1 self-assessment and annually thereafter." A Level 1 company owes a fresh assessment against the fifteen requirements, not just a new signature. For Level 2 (Self), 170.16 sets the assessment interval at "every three years," while 170.22(b)(2) requires an affirmation at completion and "annually following a Final CMMC Status Date," plus another after any POA&M closeout.
When is my date, exactly?
Not November 10 for everyone. The anniversary that matters is your own CMMC Status Date, which 170.4 defines as "the date that the CMMC Status results are submitted to SPRS." A company that posted in December has a December anniversary. What November 10 marks is the day DFARS contracts could begin to require a CMMC status, so a company that posted to meet that first requirement comes due about now.
The aside in the margin covers one wrinkle. A Level 2 (Self) program that started Conditional, with open POA&M items, and closed them out later keeps its Conditional date as the Status Date. Read with 170.22(b)(2), our reading is that the annual affirmation is counted from that original date, not from the closeout. Programs that are unsure should check the dates SPRS shows for their own record rather than rely on memory.
What does the SPRS record have to show?
More than a score. For Level 1, 170.15(a)(1)(i) lists the minimum inputs: the CMMC level, the CMMC Status Date, the CMMC Assessment Scope, "all industry CAGE code(s) associated with the information system(s)" in that scope, and the compliance result. Level 1 is scored MET or NOT MET in its entirety, and no POA&M is permitted, so a single unmet requirement leaves no Level 1 status to affirm.
For Level 2 (Self), 170.16 adds the overall score, which the rule illustrates as "105 out of 110," and whether a POA&M was used. Those fields are what a prime or a contracting officer sees, and they are what the affirmation vouches for. A CAGE code added this year for a new location, or a scope that grew to take in a new system, is a reason to update the record before the affirming official signs it, not after.
What happens if the anniversary passes?
The rule ties the affirmation to contract eligibility. Before award of a contract or subcontract that requires Level 1 (Self), 170.15(b) says the company must "both achieve a CMMC Status of Level 1 (Self) and have submitted an affirmation of compliance into SPRS." An expired Level 1 assessment, or a missing annual affirmation, is the kind of gap that surfaces at the worst moment: when a prime asks for your status on a new subcontract, or when an option is about to be exercised.
The affirmation is also not a formality you can renew by clicking. 170.22(a)(2) says it attests that the company "has implemented and will maintain implementation of all applicable CMMC security requirements" for every system in the assessment scope. If the scope changed this year, through a new office, a new cloud service or a merger, the affirming official is signing about systems the original assessment never saw.
What should a small program do this week?
Pull the SPRS record and write down three dates: the CMMC Status Date, the date of the last affirmation, and the date of the last self-assessment. Put the next affirmation on the calendar a month ahead of its anniversary, with a named affirming official and a named alternate, since 170.22(a)(1) requires "the senior level representative from within" the company.
Then do the part that makes the signature honest. For Level 1, rerun the self-assessment. For Level 2 (Self), walk the scope and the score before signing: what changed, what broke, what was added. If you want someone other than the signer to run that check, a readiness review is built for it. ◆