Affirmed when CMMC enforcement started? Your re-affirmation is coming due.

CMMC Phase 1 went live on November 10, 2025. If you submitted your Level 1 score and affirmation around then - because a contract suddenly required it, or your prime asked - your affirmation is about a year old now. That means it's close to lapsing, and nobody is going to email you when it does.

This one's for that cohort. If you affirmed in the first wave, here's what to check and when.

Why fall 2026 is a renewal cliff for early affirmers

The Level 1 affirmation is annual. Whatever day yours went into SPRS, it's good for roughly a year from that date. A lot of shops all crossed the same starting line in late 2025 when enforcement began phasing into contracts, which means a lot of shops hit the one-year mark around the same time this fall.

And here's the part that catches people: the July 2026 Phase 2 suspension didn't push this out. The pause pulled third-party certification at Levels 2 and 3. It left the Level 1 self-assessment and the annual affirmation exactly where they were. So if you've been reading "CMMC got paused" and assuming the clock stopped, it didn't - not for your affirmation.

What happens if you let it slide

An expired affirmation doesn't throw an error. It just quietly stops working for you.

• Your active, compliant status in SPRS goes stale, which can knock you out of eligibility for work that requires it.
• A prime checking your posture sees a lapsed affirmation, which reads no better than none.
• The affirmation is a senior official's legal attestation. A year-old one that no longer matches your environment is a real problem, not a paperwork lag.

None of that shows up until the moment it costs you a bid. That's exactly why it's worth handling now, while it's quiet.

Your 30-minute check

1. Find your affirmation date. Log into SPRS and look at the date on your current affirmation. That's your anchor. Add a year - that's roughly your deadline.
2. Work backward 60 days. That's when to start, because the next steps take time.
3. Re-run the assessment against your environment as it is today. Not last year's setup - today's. New laptop, new MSP, files moved to a different share: any of those can turn a "met" into a gap. The free 5-question check is the fast spot-check, no email needed to see your grade.
4. Confirm your SPRS access still works before submission week. SAM, PIEE, and the affirming official's role can each need their own renewal. The SPRS walkthrough has the full order.
5. Close any new gaps, then re-affirm. You're attesting that you meet the requirements now - so fix first, sign second.

If you want the full picture of how the annual cycle works - what renews, what "expired" means, and how the affirmation differs from the assessment - the annual affirmation renewal guide covers it end to end.

Don't wait for a prime to ask

The shops that handle this well treat renewal like an oil change: a known interval, done on schedule, before anything breaks. The ones that get caught are the ones who assumed "we did it last year" was the same as "we're current."

Run the check against today's environment. If nothing moved, you're a short SPRS session from re-affirmed. If something did, you found it on your terms instead of a prime's.

Sources

32 CFR Part 170; FAR 52.204-21; DoW CIO memo of July 13, 2026 (Phase 2 suspension); NIST SP 800-171A.