How to Do Your Annual CMMC Level 1 SPRS Affirmation, Step by Step

For CMMC Level 1, two related duties should not be confused: the organization performs an annual self-assessment and submits the results in SPRS; an authorized Affirming Official separately affirms continuing compliance in SPRS after an assessment and annually thereafter. These duties are described in 32 CFR 170.15 and 32 CFR 170.22. CyberSure does not access SPRS or submit either item for an organization.

A preparation sequence

1. Confirm the requirement and scope. Read the relevant solicitation, contract clauses, and flow-down terms. Confirm with the contracting officer or prime which CMMC status and information-system scope apply. Do not infer applicability from company size or from this article.
2. Identify the in-scope system and associated CAGE codes. Document the assessment boundary: the systems and assets addressed, how they handle FCI, and the industry CAGE code(s) associated with that system scope. 32 CFR 170.15 lists the minimum Level 1 result information, including assessment scope and associated CAGE code(s).
3. Perform the self-assessment. Evaluate the applicable Level 1 safeguards using the procedures in § 170.15, including the assessment objectives referenced there. Record the evidence reviewed and basis for each result. Level 1 requires all applicable security requirements to be MET; the rule does not permit Level 1 POA&Ms.
4. Prepare and submit the assessment result in SPRS. The OSA submits the Level, CMMC Status Date, assessment scope, associated CAGE code(s), and compliance result, at minimum. Follow the current official SPRS access and submission instructions. This assessment-result submission is not the Affirming Official's affirmation.
5. Have the Affirming Official submit the affirmation. The official must be a senior-level representative responsible for ensuring the organization's CMMC compliance and authorized to affirm continuing compliance. That official submits the affirmation electronically in SPRS, including the required identity/contact information and attestation described by § 170.22.
6. Repeat each year and retain records. Plan for the annual self-assessment/result submission and annual affirmation as separate recurring actions. Retain the assessment artifacts for six years from the CMMC Status Date as required by § 170.15. Follow current contract terms and official system instructions for the actual due dates and workflow.

The DoD small-business CMMC information page links to official program resources. CyberSure's Readiness Check can help organize an initial review; the Self-Assessment Kit includes a walkthrough and calendar for preparation. They do not perform the assessment, decide your scope, or submit anything to SPRS.

Important limits: CyberSure is a private company, not affiliated with or endorsed by DoD/DoW, the U.S. Army, or any government agency. This guide is general information, not legal advice, certification, or an official assessment. Contract and data applicability depend on the specific contract and scope; confirm uncertain requirements with the contracting officer or prime.