Affirmation. Engineered.

Under 32 CFR Part 117, organizations handling CUI must affirm annually that their CMMC compliance posture remains accurate, and the affirmation must be made by a named senior official. 1TEN tracks the obligation, documents the attestation, and surfaces the renewal deadline before it lapses.

Annual Affirmation cycle tracked

Named Senior official on record

32 CFR Part 117 compliance

What the Affirmation Requires

The annual affirmation is a formal attestation by a C-suite or senior official confirming that the organization's security posture continues to meet the requirements documented in the SSP, and that no material changes have occurred that would affect CMMC compliance status. It must be made by a named individual with authority to bind the organization, not a compliance officer acting alone.

The affirmation is tied to the organization's SPRS score: submitting it confirms that the self-assessed score posted to the SPRS portal remains accurate. If posture has changed materially (new systems added to scope, controls degraded, POA&M items unresolved beyond the accepted window), the posture must be updated before the affirmation is made.

Attestation Record and Audit Trail

1TEN captures the affirming official's name and title, the date of affirmation, the SPRS score in effect at the time, and the SSP version the affirmation covers. This creates an auditable record of each annual cycle, demonstrating continuous compliance rather than a single certification event, and providing the documentation a contracting officer or auditor would request.

The module tracks your last affirmation date and surfaces renewal reminders in the Compliance Calendar as the annual deadline approaches. Missing the affirmation deadline is a compliance gap under 32 CFR Part 117, and 1TEN makes sure it does not happen by accident.

What You See Inside

Affirming official record

Name, title, and organizational role of the senior official making the attestation.

Date and score captured

Exact affirmation date, logged and immutable, plus the SPRS score the affirmation certifies as accurate.

SSP version reference

The version of the System Security Plan in effect at the time of affirmation.

Affirmation history

A complete record of all prior affirmations with dates, officials, and scores.

Renewal reminders

Surface in the Compliance Calendar 60 and 30 days before the annual deadline.

Pre-affirmation checklist and export

Verifies open POA&M items, evidence gaps, and SPRS score are current before signing, and produces a printable attestation record for contract files or audit response.

Reference

Affirmation Requirements Under 32 CFR Part 117

Who must affirm

A senior company official, typically C-suite (CEO, COO, CTO, CISO) or equivalent with authority to bind the organization.

What is affirmed

That the SPRS self-assessment score accurately reflects the organization's current security posture.

Frequency

Annually, within 12 months of the prior affirmation.

Where it is submitted

The SPRS portal (supplier.dcsa.mil), the same system where the SPRS score is posted.

Legal exposure

False affirmations are subject to liability under the False Claims Act, 31 U.S.C. 3729 to 3733.

Trigger for early re-affirmation

Material changes to security posture, scope, or SPRS score require an updated affirmation before the annual cycle.

Practices

Requirements Satisfied

Requirement	Description
32 CFR Part 117	Annual affirmation requirement. Senior official attestation that the organization's SPRS score and security posture remain accurate.
CA.L2-3.12.4	System security plan maintenance. Affirmation records reference the SSP version in effect, supporting the currency and update history required under this practice.