The CMMC annual affirmation is a yearly confirmation, made by a senior official of your own company and submitted to SPRS, that your company still meets its CMMC requirements. Level 1 (Self) contractors self-assess and affirm every year; Level 2 (Self) contractors self-assess every three years and affirm every year. An adviser can prepare you, but the affirmation itself is yours to make.
How often: Level 1 vs Level 2 (Self)
SPRS, the Supplier Performance Risk System, is the DoD database where contractors submit their CMMC self-assessment scores. Galaxy's resources page has the official link under SPRS (Supplier Performance Risk System). How often you affirm there depends on your level:
- Level 1 (Self): contractors that hold Federal Contract Information (FCI) self-assess every year and post the results in SPRS, under 32 CFR 170.15. A senior company official affirms the results, and the affirmation is submitted to SPRS.
- Level 2 (Self): under 32 CFR 170.16, a self-assessment every three years and an affirmation every year. You assess all 110 practices, enter the score in SPRS, and a senior official affirms compliance each year.
Either way, the annual affirmation comes due on its usual date, your SPRS anniversary. For more on each level, read Galaxy's pages on the CMMC Level 1 self-assessment process and on CMMC Level 2.
Who signs: your senior company official
The affirmation comes from inside your company. For Level 1, a senior company official affirms the results. For Level 2 (Self), a senior official affirms compliance every year. An outside adviser can prepare you for the self-assessment, the SPRS submission and the affirmation, but the affirmation itself is made by your own senior official.
Choose that person ahead of time and keep the name in SPRS up to date. If last year's signer has left or changed roles, sort that out well before the due date. Give the official time to review the evidence behind the score, not just the final number.
Before you affirm: what to check
Your SPRS score is visible to DoD contracting officers and can influence contract award decisions. Submitting a score you cannot support with documentation is a federal compliance risk. Before your official affirms, check:
- Score: does it still match your latest self-assessment, and can you back it up with documentation?
- Dates: are the dates in your SPRS entry current?
- Affirming official: is the right person named?
- System Security Plan (SSP): is it current? If your environment changed in a big way, review your compliance status and update the SSP.
- Plan of Action and Milestones (POA&M): if you keep one, does it show which gaps are still open and how you plan to close them?
Start this check well before your SPRS anniversary, so there is time to fix anything you find. Galaxy's Phase 2 explainer gives the same advice in short form: keep your SPRS entry current.
What the suspension changed, and what it did not
On July 13, 2026, CMMC's move to Phase 2 was suspended by the Department of War (DoW, formerly DoD). Since then, Level 1 (Self) and Level 2 (Self) are the only levels a new requirement may call for.
What did not change is the yearly routine. During the suspension, the DoW still checks compliance through self-assessments and affirmations, and your annual affirmation still comes due on its usual date. For both Level 1 (Self) and Level 2 (Self), the yearly cycle carries on as before.
How Galaxy can help
Galaxy prepares Level 1 and Level 2 clients for the self-assessment, the SPRS submission and the annual affirmation. Its RP Staffing service includes a Level 1 SPRS submission walkthrough, plus Level 2 evidence packaging and affirmation preparation. The affirmation itself is still made by your own senior official. If you want a second set of eyes on your score, dates and documents before your official signs, that preparation is what Galaxy offers. The CMMC services page describes the Level 2 self-assessment and SPRS affirmation step.
Frequently asked questions
How often does a Level 1 contractor affirm in SPRS?
Every year. Level 1 (Self) contractors self-assess each year, post the results in SPRS, and a senior company official affirms them.
How often does Level 2 (Self) assess and affirm?
Two schedules apply: the full self-assessment every three years, and the affirmation every year, as set out in 32 CFR 170.16.
Who signs the affirmation?
A senior official of your own company. Advisers can prepare you, but the affirmation is made by your own official, so choose that person early and keep the name in SPRS current.
Do we still affirm during the Phase 2 suspension?
Yes. Affirmations are still part of how the DoW checks compliance, and yours comes due on your SPRS anniversary as usual.
What if our systems changed since the last affirmation?
Review your compliance status and update your SSP before you affirm. New systems, new contracts and staff changes are all worth checking, because the score you affirm should match how your company works today.
Get ready for your next affirmation
Galaxy offers a free initial consultation. To set one up before your next self-assessment or affirmation, contact Galaxy Consulting.