When is your CMMC Level 1 SPRS affirmation due?
Enter the date of your last SPRS affirmation. We'll tell you the exact day your next one is due and hand you a .ics calendar reminder so it never slips.
Why the annual affirmation deadline is a hard date
Under 32 CFR § 170.22, the senior affirming official at the contractor has to post an affirmation in SPRS once every 12 months. There is no 30-day grace period. There is no auto-renew. If your last affirmation was on June 1, 2025, your next one is due on or before June 1, 2026 — period.
The rule is enforced indirectly: contracting officers and prime contractors pull SPRS data and act on what they see. A stale or missing affirmation is treated as non-compliance, which in the post-November-2025 acquisition rule (48 CFR CMMC rule) means you can be passed over for awards or held off mobilization on contracts you've already won.
The bigger risk is legal. The Department of Justice's Civil Cyber-Fraud Initiative has been treating false or knowingly stale affirmations as False Claims Act violations since 2022. The settlements so far have been in the seven-and-eight-figure range. Putting a calendar reminder in place is the cheapest form of insurance on the planet.
What the affirmation actually says
The senior official is affirming, on the record, that the company continues to meet every one of the 15 safeguarding requirements in FAR 52.204-21. Not "mostly." Not "working on it." All 15, MET, today.
Before you post, run the 15 practices once — same way you did the first time. If any one of them is genuinely not met, you don't affirm yet — you fix it first, then affirm.
Frequently asked questions
Q.How often do I have to affirm CMMC Level 1?
Once every 12 months. 32 CFR § 170.22 requires the affirming official to post an affirmation in SPRS within one year of the previous affirmation. There is no grace period in the rule — if you let the date slip, your affirmation is stale and primes will treat you as non-compliant.
Q.What happens if I miss the deadline?
Your SPRS posting goes stale. Contracting officers and primes pulling SPRS data see a non-current affirmation and either pause awards or pull you off the list. A knowingly missed or false affirmation also creates False Claims Act exposure under the DOJ Civil Cyber-Fraud Initiative.
Q.Who has to sign the affirmation?
A senior official of the contractor — typically the CEO, President, or another named officer of the company. A consultant, fractional CTO, or outside advisor cannot affirm on the company's behalf.
Q.Where do I actually post the affirmation?
In the Procurement Integrated Enterprise Environment (PIEE), under the Supplier Performance Risk System (SPRS) → Cyber Reports module. The affirming official posts MET on all 15 practices and electronically affirms.
Q.Does this widget store my data anywhere?
Only in your own browser, using localStorage. The date never leaves your device, never hits a server, and is never shared. Clear your browser data and it's gone. No account, no email gate, no tracking.