CMMC Level 1 Affirmation. What Your Official Signs.

You finished the Level 1 self-assessment, or you are close, and now a question comes up that the guides gloss over. Someone at your company has to affirm the result every year, and it is not always obvious who that person is or what exactly they are putting their name to. This is the part suppliers ask about most once the checklist is done.

The short version. At CMMC Level 1, a senior official at your company affirms in SPRS that your Federal Contract Information safeguards are in place. It is an annual commitment under 32 CFR 170.22. There is no third-party assessor, no numeric score, and no way to affirm with objectives still open. The affirmation is only as strong as the record sitting behind it.

Who Actually Signs the CMMC Affirmation?

The rule calls this person the Affirming Official. It is a senior official of your company who is responsible for ensuring compliance and has the authority to affirm on the company's behalf. It does not have to be the CEO. In a small supplier it is often the owner, the operations lead, or whoever owns the contract relationship.

On the community forums this is one of the most common questions. People ask whether the CEO has to sign, whether it can be delegated, or they describe a situation where the business owner simply entered a status and no one realized a separate affirmation was still required. The plain answer is that one accountable senior person affirms, and that person should understand what they are attesting to before they do it.

What the Annual Affirmation Says

When your Affirming Official affirms, they are stating that your company has met the Level 1 requirements to protect FCI and that the information in SPRS is accurate. It is a formal attestation, made once a year, recorded in the Supplier Performance Risk System.

Two things make this weightier than a checkbox. First, it is annual. You reassess and re-affirm every year, so the person signing is committing to a state that has to stay true over time. Second, it is a statement the government relies on. An affirmation is only as strong as the assessment behind it. That is not a reason to fear the affirmation. It is a reason to make sure the record behind it is real before anyone signs.

What Should Sit Behind It Before Anyone Signs

An affirmation is a claim. What defends the claim is the assessment record underneath it. Before your official affirms, that record should hold three things.

• Every applicable objective resolved as MET or N/A. There is no Plan of Action and Milestones at Level 1, so you cannot affirm with work still open.
• The evidence behind each determination, held in one place rather than scattered across laptops, email, and a shared drive.
• A retention plan, because you are required to keep the assessment and its evidence for six years under 32 CFR 170.15.

If your official can see all of that in one view, the affirmation is a short, confident step. If they cannot, the affirmation is a leap of faith, and that is exactly the position no senior official wants to be in. You can see how we organize that record on the product overview, and how the stored evidence is protected on our security page.

The One Detail That Trips People Up

Entering an assessment status and affirming it are two separate actions. Suppliers routinely describe entering a status, assuming they were done, and only later learning that the affirmation step was never completed. Others describe the opposite worry, that the affirmation "felt too easy" because it was a single confirmation.

Both reactions come from the same gap. The click is small. The thing that makes it meaningful is the assessment and the evidence behind it. If the affirmation is never completed, the record is not valid. If it is completed without a real assessment underneath, it is a claim you cannot defend. The work is in the record, not the click.

The Record Behind the Signature

This is the moment AssessrLog was built for. It is the system of record where your Level 1 self-assessment lives, so when it is time to affirm, your Affirming Official is handed a clean, defensible package. Each determination, the evidence attached to it, and the history of how you got there, in one place they can actually review before they put their name on it.

One boundary we hold firmly. AssessrLog assembles the package. It never submits and never affirms for you. That step stays with your official, by design.

Frequently Asked Questions

Who can be the Affirming Official for CMMC Level 1? A senior official of your company who is responsible for ensuring compliance and has the authority to affirm on the company's behalf. It does not have to be a C-level executive, and in small suppliers it often is not.

How often do I have to affirm? Annually. You reassess and re-affirm each year, and you keep the assessment and evidence for six years.

Is the affirmation the same as a CMMC certification? No. Level 1 is a self-assessment that you affirm yourself. No outside body certifies you at Level 1. Third-party assessment applies to Level 2 and CUI, not Level 1.

Can I affirm with a few objectives still open? No. There is no Plan of Action and Milestones at Level 1. Every applicable objective must be MET or N/A before your official affirms.

Does AssessrLog submit or affirm for me? No. AssessrLog assembles the record and readies the package. Entering the status and affirming in SPRS are steps your official performs. We never submit and never affirm on anyone's behalf.