CMMC 2.0: Operationalizing the Affirming Official Role

Defining the Affirming Official

Under 32 CFR Part 170, the Affirming Official (AO) is the senior-level representative within an Organization Seeking Assessment (OSA) responsible for ensuring compliance with CMMC requirements. This role carries significant weight, as the AO must have the authority to affirm the organization's continuing compliance with security requirements. This is not a task to be delegated to junior IT staff; it requires executive-level accountability for the organization's cybersecurity posture.

The SPRS Affirmation Workflow

Compliance is managed through the Supplier Performance Risk System (SPRS). To perform the affirmation, the AO must have a Procurement Integrated Enterprise Environment (PIEE) account with the 'SPRS Cyber Vendor User' role. The process involves reviewing the CMMC assessment details and certifying the affirmation statement.

Key technical steps for the AO include:

• Accessing the 'Cyber Reports (CMMC & NIST)' menu in SPRS.
• Reviewing the most recent assessment, which appears at the top of the grid.
• Ensuring the affirmation is completed within the 60-day window prior to the expiration date.

Compliance Lifecycle Management

| Phase | Requirement | Frequency | |---|---|---| | Initial Assessment | Conduct self-assessment against NIST SP 800-171 | Annual | | SPRS Entry | Upload assessment scores and system security plan | Annual | | Affirmation | AO certifies compliance in PIEE/SPRS | Annual | | Expiration | Assessment status expires after 3 years | Triennial |

Risk Mitigation and Governance

Failure to maintain an accurate and affirmed status in SPRS can lead to exclusion from DoD solicitations. Practitioners must treat the SPRS entry as a living document. If your security environment changes—such as the introduction of new cloud services or changes in CUI handling—the assessment must be updated. The AO must ensure that the internal governance process captures these changes before the annual affirmation. By integrating CMMC compliance into your standard capture and proposal operations, you ensure that your firm remains 'bid-ready' at all times, avoiding the last-minute scramble that often leads to compliance gaps.