After you pass a CMMC assessment, you must keep every applicable requirement implemented across your assessment scope, submit an affirmation each year, close any POA&M within 180 days, and reassess within three years. Your status in SPRS gates contract awards, so monitoring between assessments is how you protect revenue.
What does the rule require after the assessment?
Under 32 CFR 170.22, an Affirming Official, a senior person with authority for the organization, affirms continuing compliance after each assessment and annually after the Final status date. The affirmation states that you have implemented and will maintain all applicable requirements across the information systems in your scope. It is entered in SPRS, and the Department checks SPRS to confirm eligibility for solicitations.
For Level 2 self assessments, 170.16 says to reassess every three years and to retain assessment artifacts for six years from the status date. The text on certification assessments ties a three year window to the Conditional status date.
What happens if you left items on a POA&M?
A Conditional status requires a score ratio of at least 0.8, with limits on which items may be open. Under 170.21 a POA&M must be closed out within 180 days of the Conditional status date, using a closeout assessment of only the items that were not met. Miss the window and the Conditional status expires. If that occurs mid contract, standard contractual remedies apply and you are ineligible for new awards that need that level until you earn a new status.
Put the 180 day date in the calendar on day one, with an internal deadline at day 120.
What can break your status without anyone noticing?
Drift. Nobody decides to lose compliance; it erodes. Common causes: a new SaaS tool begins to receive CUI by email forwarding, an engineer opens a firewall rule for a test, a laptop is replaced without the endpoint agent, a contractor keeps access after the project, or an external service provider changes terms. Each one moves the assessed environment away from the one in your system security plan.
Also note that DoD can run its own assessment through DCMA DIBCAC, and the rule says adverse results take precedence over an existing status.
What should the monitoring routine look like?
Set a cadence by risk. Weekly or continuous: alerts for configuration changes in the boundary, endpoint health, and log pipeline checks. Monthly: vulnerability scan review with owners and dates, privileged access list review, and a check of new tools against the CUI boundary. Quarterly: user access review, backup restore test, and a review of external service provider evidence. Yearly: full requirement walkthrough, system security plan update, incident response exercise, affirmation, and a mock assessment of a sample of requirements.
Use change control as a gate. Any change touching the boundary needs a question: does the system security plan, inventory or network diagram change? If yes, update it in the same ticket.
Who owns it?
Name the Affirming Official, a compliance owner who runs the calendar, and a technical owner per control family. The Affirming Official should receive a short monthly report with open findings, expiring evidence and boundary changes, because they sign the statement.
What evidence do you keep?
Keep dated records for each cycle: scan results and remediation tickets, access review sign offs, change tickets with plan updates, training logs, incident exercise notes, ESP reviews and the signed affirmation. Six years is the retention period stated for self assessment artifacts.
What to do
- Calendar the affirmation date, the three year reassessment date and any POA&M deadline.
- Assign an Affirming Official and a compliance owner.
- Gate boundary changes through change control that updates the plan and diagrams.
- Run weekly alerts, monthly scan and access checks, and quarterly restore and access reviews.
- Collect evidence on a schedule and file it by requirement.
- Review external service providers every quarter.
- Run an annual mock assessment on a sample before the affirmation.
- Report to the Affirming Official monthly.
Quick check
How often must we affirm?
After every assessment and annually after the Final status date, by an Affirming Official, with the entry made in SPRS.
What if a POA&M item is still open at day 181?
The Conditional status expires, and you cannot be considered for awards needing that level until you earn a new status.
How Safeguard helps automate this
Continuous monitoring is where manual programs fall behind. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between assessments, saving your team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation is available: the agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready; the assessment is done by an authorized or accredited third party. Book a call.
Sources
- 32 CFR 170.22, Affirmation
- 32 CFR 170.21, POA&M
- 32 CFR 170.16, Level 2 self-assessment
- 32 CFR 170.17, Level 2 certification
Last reviewed: 18 October 2026.
