CMMC 2.0: Operationalizing SPRS Affirmation Governance

The Shift to Affirmation Governance

With the CMMC 2.0 Final Rule effective as of December 16, 2024, the focus for defense contractors has shifted from mere "compliance" to "affirmation governance." Under 32 CFR § 170.18, contractors are now required to provide formal affirmations of their cybersecurity posture in the Supplier Performance Risk System (SPRS). This is not a clerical task; it is a legal certification that carries significant weight under the False Claims Act.

Managing the SPRS Scorecard

For many firms, the SPRS score is the primary indicator of compliance readiness. However, a high score is meaningless if the underlying System Security Plan (SSP) and Plan of Action and Milestones (POA&M) are not maintained in real-time. Per DoD CIO guidance, contractors must ensure that their self-assessments are grounded in the 110 controls of NIST SP 800-171.

Key Governance Steps for Compliance

• Continuous Monitoring: Move beyond annual "check-the-box" assessments. Implement automated log monitoring to track configuration changes.
• Evidence Repository: Maintain a centralized, audit-ready folder containing artifacts for every control. If you cannot produce the evidence during a spot check, the control is effectively failed.
• Affirmation Review: Before submitting an affirmation in SPRS, conduct a "pre-flight" review with legal counsel to ensure that the current security posture matches the reported score.

The Role of DIBCAC Assessments

For contractors handling sensitive Controlled Unclassified Information (CUI), the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) may conduct independent assessments. As noted in the CMMC Level 3 Assessment Guide, only results from a DIBCAC assessment are considered for the award of a formal CMMC status.

| Assessment Type | Frequency | Primary Focus | |---|---|---| | Self-Assessment | Annual | NIST SP 800-171 compliance | | DIBCAC Assessment | As Required | Validation of CUI protection | | Affirmation | Per Contract | Legal attestation of posture |

Contractors must treat the SPRS affirmation as a living document. Any material change in your network architecture or security controls requires an immediate re-evaluation of your SPRS score to avoid potential liability.