Who Can Be Your Affirming Official — and What They're Signing

A CMMC Level 1 self-assessment doesn’t end when you finish answering the questions. It ends when a senior person in your company puts their name to the result and submits an affirmation.

That step gets treated as paperwork. It isn’t. It’s the point where your assessment becomes a statement to the government, and it’s worth understanding before someone signs it.

What the rule says

The CMMC rule describes the Affirming Official as the senior level representative within your organization who is responsible for ensuring compliance with CMMC requirements and who has the authority to affirm the organization’s continuing compliance.

Two things follow from that wording.

It has to be someone inside your company. Your consultant can’t do it. Neither can your managed service provider, your registered provider organization, or anyone else external. They can help you prepare, they can advise, they can do the legwork — but the affirmation is yours.

It has to be someone senior enough to mean it. In a small contractor that’s usually the owner or president. In a slightly larger one it might be a COO, CIO or CISO. What it should not be is whoever happened to be doing the work — handing the role to an office manager or an IT technician because they were closest to the keyboard misses the point of the role.

What they’re actually attesting

The affirmation is submitted electronically in SPRS and records the affirming official’s name, title and contact details. In substance it states that your organization has implemented, and will continue to maintain, the applicable security requirements for the systems in scope.

Note the second half. It isn’t only a claim about the day you assessed. It’s a forward-looking commitment that the controls stay in place.

The submission flow itself carries warnings referencing 18 U.S.C. § 1001 and the False Claims Act. Those aren’t decoration. An affirmation that misstates your compliance is a false statement to the government, and the False Claims Act reaches “any person” — with “knowingly” defined to include reckless disregard and deliberate ignorance, not just deliberate lying.

That matters for how the role should be performed. An affirming official who signs without having seen the assessment is, in the Act’s language, operating fairly close to deliberate ignorance.

When it happens

The affirmation is submitted after the assessment, and then annually after that. A CMMC status is considered current only while backed by an affirmation less than a year old.

Put the renewal in a calendar now. An affirmation that quietly lapses is a compliance gap that nobody notices until a contract is on the line.

How to choose the right person

Three things make someone a good fit:

Authority. They can direct resources to fix a gap. If they’d have to ask permission to buy a $200 tool or require a department to change a practice, they’re not senior enough.

Enough understanding to not sign blind. They don’t need to be technical. They need to be able to read the assessment, ask why a requirement was marked met, and get an answer that makes sense.

Accountability they’re willing to hold. They should want to see the evidence. If the prospect of personally attesting makes them ask harder questions, that’s the system working.

What good practice looks like

Walk the affirming official through the assessment before they sign. Not a summary — the actual results, requirement by requirement, with the reasoning. In a Level 1 assessment that’s a short meeting, because there are only 15 requirements.

If any of them produce an uncomfortable pause, that’s the valuable part. Better to find it in your own conference room than in a dispute about an award.

Keep a record of what the affirming official reviewed and when. You’re required to retain the supporting artifacts anyway — see what records you need to keep — and a note of the review costs nothing to add.

The bottom line

The affirming official is a senior person inside your company, not a vendor, and what they sign is a statement to the government about both your current and continuing compliance.

Choose someone with real authority, make sure they’ve actually read the assessment, and diarise the annual renewal. For the submission mechanics, see how to submit and affirm in SPRS.