KNOWLEDGE BASE • UNDERSTANDING CMMC LEVEL 1 AND SPRS
Maintained by AffirmReady Support
If you have heard that your company needs to "affirm" CMMC Level 1 every year and want to understand what that means and who should do it, this article explains the basics.
The short answer
Each year, your company assesses itself against the 15 CMMC Level 1 requirements and enters the results in SPRS, the Supplier Performance Risk System. A senior official at your company then affirms in SPRS that the company meets the requirements. Both steps repeat every year for as long as the requirement applies to your contracts.
The two parts
- The annual self-assessment
Your company reviews how it meets each of the 15 requirements. At Level 1, every requirement must be met. There is no partial credit and no option to list open items to fix later, so any gaps should be closed before your company records its results.
- The annual affirmation
A senior official at your company formally states in SPRS that the company meets the Level 1 requirements. This is your company's own statement to the government about its cybersecurity.
Who signs the affirmation
The affirmation is made by your company's Affirming Official. This is a senior representative of the company who is responsible for making sure the company meets its CMMC requirements and who has the authority to make the affirmation on the company's behalf. In a small business, this is usually the owner, president, or another senior executive.
Choose someone who will actually review the results, not just sign. They are attesting to the accuracy of the self-assessment, so they should understand how each requirement is met and be comfortable with the evidence behind it.
How SPRS is accessed
SPRS is accessed through the Department of Defense's Procurement Integrated Enterprise Environment, known as PIEE. The people entering results and making the affirmation will need PIEE accounts with the appropriate SPRS access for your company. If you have not used PIEE or SPRS before, allow extra time to get set up before your first affirmation.
Why accuracy matters
Because the affirmation is a formal statement to the government, affirming compliance when requirements are not actually met can create serious legal and contractual risk for your company. If you are unsure whether your company is ready, resolve the open items first, and consider getting professional advice.
How AffirmReady helps
AffirmReady helps you prepare for both parts. The guided walkthrough takes you through all 15 requirements, the evidence register shows your Affirming Official where the supporting evidence lives, and reminders arrive before your annual affirmation is due. AffirmReady does not submit anything to SPRS on your behalf. Your company enters its own results and makes its own affirmation.
Important
This article is a plain-language summary, not legal advice. Your company is responsible for its self-assessment, its affirmation, and understanding the requirements in its own contracts.
Still need help?
If you have questions about preparing for your affirmation, Email support@affirmready.com and include your company name and the email address on your AffirmReady account. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and replies within one business day.