Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
Finish · Attest and file
Ready to attest, signed by its own senior official.
Meridian Defense Systems, Inc. ran every readiness check the self assessment needs. Then Elena R. Marsh recorded the score, posted it in the SPRS CMMC Assessments module through PIEE, and affirmed it. That is the last step: a Level 2 self assessment on the record and the senior official's self attestation behind it, renewed every year.
Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
- System identified and Affirming Official designatedMeridian CUI Enclave, Elena R. Marsh
- Every CAGE code covered by the scope is named1 CAGE code: 7ML52
- Controlled files listed (where CUI is processed, stored, or transmitted)6 flows documented
- Assets categorized, boundary drawn3 CUI assets, 10 assets and 2 providers categorized
- Network diagram saved (the scoping picture)Version 2 saved, drawn from the scope board
- A Customer Responsibility Matrix started for every providerBoth providers have CRM rows
- All 110 requirements resolved at the objective level110 of 110 resolved
- Every “does not apply” has a written reasonNo unexplained exclusions
- Implementation sections written or accepted by a person (the SSP body)All 110 written or accepted by a person
- Score 110, or Conditional-eligible with a complete POA&MScore 110 of 110
- The 14 policies adopted in final form14 of 14 adopted in the Policy Center
- Evidence behind every MET requirement (proven, not just claimed)All 109 MET requirements have passing evidence
- Every MET carries the method that proved it (examined, interviewed, or tested), named and dated319 method records on the assessment
- SSP read and approved (final form, current)Approved 2026-07-21
A pro checks it
A credentialed officer reviews every step before your senior official signs. The officer never signs. The findings are the team's, and the affirmation is the senior official's own act (32 CFR 170.22).
The affirmation
Affirmed by Elena R. Marsh, Chief Executive Officer and the Affirming Official, at the assessment and again at the POA&M closeout.
- At assessment · Self track · Elena R. MarshMarch 11, 2026
- POA&M closeout · Self track · Elena R. MarshJuly 22, 2026
POA&M closed out
Recorded Conditional at 106 on March 11, 2026 with 4 items on the plan of action. The closeout self assessment was recorded with a score of 110, posted July 22, 2026. That is Final Level 2 (Self). See the score and the closed items
The SPRS record
Open it on its own page to print →- CMMC Status
- Final Level 2 (Self)
- CMMC level
- 2
- Assessment scope
- Meridian CUI Enclave
- CAGE codes covered
- 7ML52
- Score
- 110 of 110
- POA&M used
- Yes, closed out July 22, 2026
- Conditional Status Date
- March 11, 2026, at 106
- CMMC Status Date (Final)
- July 22, 2026
- CMMC UID
- K7QX4M2R9T
- SAM UEI
- MD8QK4R2XP71
- Affirming Official
- Elena R. Marsh, Chief Executive Officer
- Posted in
- SPRS through PIEE (piee.eb.mil)
Contracting officers check SPRS before award. A Level 2 (Self) status meets a solicitation that names Level 2 (Self), and a solicitation that names Level 1 as well, since a higher status covers a lower one.
The other SPRS posting: the NIST SP 800-171 Basic Assessment
Contracts carrying DFARS 252.204-7019 and 7020 also require a NIST SP 800-171 Basic Assessment score in SPRS, posted in the legacy NIST SP 800-171 assessments table and not more than three years old. That is a separate record from the CMMC Level 2 (Self) status. Same score, same scope description, two postings.
It stays true
Keep it current
Level 2 is a year round posture, not a one time filing. Miss the annual affirmation and the status lapses: no new Level 2 awards, and option exercises on existing contracts fail the SPRS check (DFARS 204.7503(c)).
Next annual affirmation
July 22, 2027
A year after the latest one, logged July 22, 2026 at the POA&M closeout. The renewal window opens May 18, 2027.
Full self assessment due
March 11, 2029
Three years from the Conditional date, March 11, 2026; the closeout does not restart it (32 CFR 170.16(a)(1)).
Records kept six years
July 22, 2032
Every sealed version is kept six years from its CMMC Status Date (32 CFR 170.16(c)(4)). Version 4, affirmation, is kept until then.
Before you re affirm
Check what is true today. These are notes for the senior official's review, not locks: the affirmation stays with the person who signs.
- Open POA&M itemsNothing open. Your plan of action is clear.0
- Evidence past its freshness windowEverything on file is inside its freshness window.0
- Boundary additions since the recordNo additions to your inventory since the record.0
- Changes after the System Security Plan approvalSSP approved 2026-07-21, and nothing changed since.0
Logging next year's re affirmation seals version 5 of the whole record, hashed and signed. See the sealed versions
Your team works all 110 requirements on the platform, a credentialed officer reviews every step, and the record stays true all three years. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.