If you are trying to understand what role AffirmReady plays in your CMMC process, and what it does not do, this article explains it.
The short answer
AffirmReady is a software platform, launching soon, designed to help small businesses prepare for CMMC Level 1. It is not a C3PAO, it is not a law firm, and it does not provide legal advice. It does not certify, assess, or approve your company's compliance.
What is a C3PAO, and do I need one for Level 1?
A C3PAO (CMMC Third-Party Assessment Organization) is an organization authorized to conduct formal CMMC assessments. Many contracts that require CMMC Level 2 also require a C3PAO assessment.
CMMC Level 1 is handled differently. Companies complete an annual self-assessment and a senior official at the company submits an annual affirmation in SPRS. A C3PAO assessment is not part of the Level 1 process.
What AffirmReady is designed to do
AffirmReady is being built to help small defense contractors understand the 15 CMMC Level 1 requirements in plain language, find their gaps, and get organized before their company completes its annual self-assessment and affirmation.
What AffirmReady does not do
- It does not provide legal, compliance, or consulting advice, or interpret your specific contracts.
- It does not certify, assess, or verify that your company is compliant.
- It does not submit your self-assessment or affirmation to SPRS.
- It does not connect to, monitor, or change your systems.
- It does not cover CMMC Level 2 or other frameworks.
- It is not a Registered Provider Organization (RPO) or a government agency, and it is not affiliated with or endorsed by the Department of Defense or The Cyber AB.
Who is responsible for my affirmation?
Your company is. The senior official who submits the annual affirmation is attesting that your company meets the requirements. Tools and advisors can help you prepare, but the decision to affirm, and responsibility for its accuracy, stays with your company. See What does the annual affirmation involve, and who in my company signs it?.
When should I get professional advice?
Consider speaking with an attorney or a qualified compliance professional if you are unsure whether your contracts require CMMC Level 1 or Level 2, whether you handle Controlled Unclassified Information (CUI), or whether you are ready to affirm. Your IT provider can also help you implement and document technical safeguards.
Still need help?
If you have questions about what AffirmReady can help with, email our support team at support@affirmready.com and include your company name. We typically respond within one business day.