The signature is annual, but the operating work happens all year
What CMMC annual affirmation requires and how to maintain the implementation record, evidence, changes, decisions, and open items throughout the year.
Affirmation occurs after assessment and annually thereafter
The statement covers continuing implementation of applicable requirements
Supporting evidence is maintained by the organization, not automatically uploaded with every affirmation
Changes and unresolved items should be reviewed before signature
Understand what the official is attesting to
The rule requires a senior representative with authority to affirm continuing compliance for the relevant assessment scope. The statement is about implemented and maintained security requirements, not merely possession of an unexpired certificate.
Prepare the review from a year of operating records
A responsible review should reconcile the current scope, changes since assessment, evidence status, provider responsibilities, POA&M status where applicable, unresolved exceptions, and material decisions.
- Current assessment scope and CMMC status
- Significant system, provider, personnel, facility, or CUI-flow changes
- Evidence ledger and refresh status
- Open missing, stale, draft, or blocked items
- POA&M and closeout status where applicable
- Qualified-advisor and leadership decisions
Do not turn the annual date into the only review
Monthly or quarterly operating visibility lets leadership address drift when it occurs. The annual preparation then becomes a structured review of known facts instead of a rushed search for evidence.
Concrete, client-owned operating records
Facts, not verdicts
Gridex prepares factual operating records. Gridex does not advise that an official should affirm, submit the affirmation, or assume the official’s legal responsibility.
Frequently asked questions
Must supporting evidence be uploaded with the annual affirmation?
Section 170.22 describes the affirmation information and electronic submission in SPRS; it does not turn the annual affirmation into an automatic upload of the full evidence corpus.
What happens if affirmation is not maintained?
DoD materials state that the CMMC status can lapse when the required annual affirmation is not completed, affecting contract eligibility.
Source context
Bring the evidence state you actually have.
Gridex will map the operating work, the human judgment boundary, and the safest next step.