CMMC Level 1 isn't a one-time thing. It's a yearly cycle: review, refresh, sign, post. The annual affirmation is the single artifact that keeps your bid-ready status alive in SPRS. Skip it and your status quietly goes stale.
Why the annual is the hardest part
- There is no built-in reminder from DoD — the burden is on you.
- It's 11 months after the work that made it easy to remember.
- It requires the affirming official, who is usually the busiest person in the company.
- The review work is real (not just a signature), so it can't be done in five minutes the night before.
The three-reminder calendar (steal this)
Set three calendar reminders today, on the affirming official's calendar:
- 11 months after posting: “CMMC annual affirmation due next month — start review.”
- 11.5 months after posting: “CMMC annual review due in 2 weeks — block 1 hour.”
- 11.75 months after posting: “CMMC annual: do not let this slip past today.”
Three reminders feels like overkill until you're the person who almost missed it.
The 10-point review
Before re-signing, walk through:
- Did anyone in scope leave the company? Were their accounts revoked?
- Did anyone new join who handles FCI? Are they listed in the worksheet?
- Did we add or remove cloud apps in scope?
- Did the network change (new firewall, new ISP, new office)?
- Is MFA still enforced everywhere? Spot-check.
- Is endpoint antivirus / Defender still active on every in-scope device?
- Are patches current? Spot-check 2–3 devices.
- Did we have any security incidents this year? Are they documented?
- Are the 8 policies still accurate? Re-sign with this year's date.
- Does the SSP still reflect reality? Update anything that drifted.
Get the printable guide
The Custodia annual affirmation guide includes the calendar template, the 10-point review checklist, and the sign-off block, all on a printable page: Open the annual affirmation guide →
Or follow the full DIY path: The Free DIY CMMC Level 1 Handbook.
FAQ
When is the annual affirmation due?
Within one year of the previous affirmation. If you posted on June 15, 2025, the next affirmation is due by June 15, 2026. There is no DoD-wide due date — your clock starts on the day you posted.
What happens if I miss it?
Your SPRS record goes stale. Primes who check your status will see an expired affirmation and treat you as non-compliant. Contracting officers may exclude you from awards until you re-affirm.
Does the same person have to sign each year?
Not necessarily — the affirming official can change (new CEO, new delegated CIO). But it must still be a senior official authorized to bind the company.
Do I have to redo the SSP and scoping every year?
You have to review them and update anything that changed. If nothing changed, the review itself is the deliverable — usually a single line: 'Reviewed 2026-06-15, no material changes.'