Who Signs the CMMC Affirmation for Your Company?

CMMC is increasingly important for any company that is even tertiary to the Department of Defense and the defense industrial base. Prime contractors are prime targets, but even two, three, four, or more steps down the chain, CMMC may be mandatory. It's all about protecting information, after all.

This means a lot of businesses are looking seriously at CMMC, and a lot of high-level executives are being asked to put their names on things they might not understand at a glance. But, with severe consequences on the line, it's more important than ever to know what's going on.

So, what is a CMMC affirmation, who signs it, and what weight does that signature carry?

What is a CMMC Affirmation?

CMMC is a complex and high-stakes information security framework, and it's required for any business that wants to work with the Pentagon or with any defense contractor. It's all about security particular kinds of information: specifically, Federal Contract Information and Controlled Unclassified Information.

It doesn't matter how many degrees of separation removed you are from the Pentagon yourself; if you handle one of these kinds of information, you need CMMC.

Knowing you need CMMC is step one. Step two is putting it into practice. That's no small task, with over 100 security controls and countless details you need to get right. There's a huge amount of paperwork, documentation, evidence-gathering, technical implementation, engineering, planning, personnel training, and more all involved in this process.

When it's all done, and you get a C3PAO to sign off on your work, you pick an affirming official to sign an affirmation and submit it to the SPRS, the Supplier Performance Risk System, a federal database recording the compliance of all defense contractors and subcontractors.

The affirmation is a statement. Critically, it is not just a statement that all security controls are implemented. Rather, it's a statement that the currently reported results of an assessment are accurate. You can (and in fact must) submit an affirmation even if you have POA&Ms.

The only time you can't submit an affirmation is if you don't meet the minimum score necessary to achieve even conditional compliance. There's no reason to submit an affirmation that you aren't there yet, after all.

What Goes into a CMMC Affirmation?

The CMMC affirmation is outlined in the federal register under the CMMC final rule. It can be found in the conveniently named Title 32 Subtitle A Chapter I Subchapter G Part 170 Subpart D section 170.22.

As stated in the final rule:

Each CMMC affirmation shall include the following information:

1. Name, title, and contact information for the Affirming Official; and
2. Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC status for all information systems within the relevant CMMC Assessment Scope.

Simple, right? It's just one more form, as the capstone to all of the work that has been done to comply with CMMC controls up to this point.

How Often is the CMMC Affirmation Submitted?

A CMMC Affirmation happens at least once a year. There are five trigger events that require a new affirmation.

The first is when you receive a conditional CMMC status. This is what you get if you mostly pass a CMMC assessment, but have a few things you need to fix via POA&Ms before you can achieve full CMMC compliance.

The second is when you receive a final CMMC status. This is what you get if you pass a CMMC assessment with flying colors and have no POA&Ms to close out; alternatively, it's what you get when you close out your final POA&M and have no more gaps in your compliance.

The third is when you finish a POA&M closeout assessment. When you finish up a POA&M and pass a fresh closeout assessment that validates your final security status, you report this new status via a new Affirmation.

The fourth is if a material change occurs to your compliance posture. If something happens, good or bad, that changes the way your security functions, you will need to report this change. Changes in compliance status must be reported with an updated SPRS score. Some organizations try to hide behind a prior affirmation, but this is a fast track to FCA liability.

Notably, one of the big material changes you might encounter is if your affirming official leaves the organization. You cannot have a gap in administration here; if the person whose name is on the paperwork leaves your organization, you need to submit a new affirmation with a new name ASAP.

The fifth is annual re-affirmation. While the full CMMC assessment is only required every three years, all levels of CMMC require annual self-assessment and re-affirmation.

In practice, this means submitting several affirmations during the process of finishing up an initial CMMC implementation, and then keeping the ball rolling with annual affirmations unless something significant changes.

Who is a CMMC Affirming Official?

The affirmation itself is a relatively simple document; what really matters is the name on the page.

Who is your affirming official?

CMMC does not specify who needs to be your affirming official, and "affirming official" is not a role you hire someone to fill. It's also not a placeholder, like it used to be. Before the recent Final Rule, the Affirmation was signed as the company, with no individual holding responsibility. The new Final Rule requires a specific person to put their name on the line.

Your affirming official needs to be someone high up in your organization. But they can't be someone who is completely disconnected from the company operations or from compliance and security.

Your affirming official must be someone who has the authority and responsibility to guide the company to compliance, commit to maintaining that compliance, and ensure it's all taken seriously.

For many organizations, this ends up being the CEO. For others, it might be another C-suite executive like a Chief Information Security Officer. Others might have a Director of Information Security take on the responsibility.

What you wouldn't do is pick someone who has no rights or responsibilities. You generally won't pick your Chief Financial Officer, or your Director of Human Resources, or your IT middle managers.

You cannot designate a lower-level employee as the "fall guy" in case things go bad.

The other thing that often catches out execs is awareness. The person signing your affirmation must actually know what they're signing, and what it means. This is why technical roles are often chosen, because they're the same people guiding the overall CMMC implementation. Putting a form in front of an absentee CEO and getting it rubber-stamped can be a source of liability.

What Happens if an Affirmation Goes Wrong?

Affirmations are effectively binding legal documents. They are a mandatory statement as to your CMMC compliance situation, signed by someone with responsibility and authority. This statement is made to the government via the SPRS database.

It is a claim made to the government by your organization. If that claim is not accurate, what you have done is made a false claim. This is where the False Claims Act comes into play.

The False Claims Act is a very, very old piece of legislation that just makes it illegal to lie to the government as a government contractor.

If you submit an affirmation, and it turns out that the claims you made in that affirmation are false, you can be held liable.

This is why it's important to have someone with authority sign the paperwork. If you could designate an intern to eat the penalty if something goes wrong, it wouldn't be punitive, and companies would get away with a lot.

This is also why it's important to have awareness. In the past, it was common for IT directors to do the work, CEOs to rubber stamp it, and if something went wrong, they would disavow knowledge. This made it a lot harder for the government to prove deliberate misrepresentation rather than ignorance, which allowed companies to get away with a lot.

The affirming official rules in the Final Rule close these loopholes by putting the onus squarely on someone who a) has to know what's going on and b) has the authority and responsibility to handle it.

All of this ensures that, if a false claim is made through an affirmation, there's a good chance it's deliberate.

What Are the FCA Penalties for a Bad Affirmation?

If you submit an affirmation, and it is later discovered that your affirmation was knowingly submitted while being untrue, the government can sue your organization under the False Claims Act. We've covered this in greater detail here if you want more information.

The lawsuit is usually settled with a fine, and these fines can be significant. They frequently include:

• Up to $250,000 per violation; plus
• Tens of thousands per false record; plus
• The potential for treble (that is, triple) damages.

A false record can be pretty much anything you've done since you submitted a false score and affirmation. Every monthly invoice for every contract that was predicated on your CMMC security is an individual record.

This isn't a theoretical calculation, either. Numerous FCA lawsuits have been processed and settled against all manner of federal contractors. The government isn't just going after the little guys, either; companies like Raytheon have faced these penalties as well. In 2025 alone, the DOJ settled and recovered over $52,000,000 from just nine settlements.

While the financial penalties are paid by the companies, the affirming official also bears significant responsibility. These individuals frequently face significant reputational damage and can lose their roles and find it hard to get another down the line. Once you've been caught lying to the government and costing your organization millions, it's a pretty big red flag on your resume.

How to Handle Being the Affirming Official

If you've been selected to be the individual putting their name on the CMMC affirmation, it should not be a surprise. After all, the affirmation comes at the end of the long process of implementing CMMC security, and since the affirming official should be someone guiding that process, you should already be neck-deep in it.

Even if you've delegated most of the work, you still need awareness. Here are some things you should do.

• Read and review CMMC assessment results. You should understand at least the basics of how CMMC works, what security controls are included, and how your SPRS score is generated. Remember, POA&Ms are acceptable; misrepresenting yourself as not needing them is not.
• Specifically investigate the prohibited controls. In CMMC, six specific controls are absolutely required, such that if they are not met, you don't get certification. Make sure to know their status specifically, and don't sign an affirmation if they aren't met.
• Recognize the responsibility, now and in the future. Being the affirming official means bearing a significant responsibility, not just at the time of signing, but for each additional affirmation in the future for as long as you have this role in your company.
• Consider legal counsel. It's not a bad idea for an organization seeking certification to retain legal counsel from a specialist who is familiar with CMMC. This legal counsel can serve as a third-party validation that putting your name on the affirmation is acceptable, and that you aren't exposing yourself or your company to FCA liability.

Yes, it's a lot of work for just a signature. But, it's really not just a signature, is it?

How Ignyte Can Help

Here at Ignyte, we're experts in CMMC, and we know both how to evaluate your implementation and ensure you know the lay of the land. The Ignyte Assurance Platform was designed to serve as an easy-to-use, centralized monitor for your security posture, not just with CMMC but across security frameworks.

That means you can use the Platform to help your organization achieve compliance, track your current state of security, and get an at-a-glance read on your security posture. If nothing else, if the affirmation you need to sign says something and the Platform disagrees, it's a good sign you need to investigate.

To see how the Platform works and how Ignyte can help firsthand, book a demo today.