Your CMMC Level 1 affirmation expires every year. Here's how renewal works.

A lot of small shops treat Level 1 like a driver's test: pass it once, you're done. It's closer to a registration sticker. You do it, it's good for a year, and then it lapses - quietly, with no letter in the mail telling you the clock ran out.

Here's how the annual cycle actually works, what "expired" means for your eligibility, and what to line up before your date comes around.

What renews, and how often

Level 1 has two things on an annual clock, and they're easy to mix up.

• The self-assessment. You work through the 15 requirements of FAR 52.204-21, score yourself against the published assessment objectives, and confirm you meet all of them. Level 1 is pass/fail - all 15 met, no partial credit, no plans of action. You redo this every year.
• The affirmation. A senior official at your company affirms in SPRS that you're meeting the requirements. This is a separate, annual attestation, and it's the piece people forget. The self-assessment is the work. The affirmation is the signature that says the work is current.

Both live under the CMMC rule at 32 CFR Part 170. Both are annual. Neither was touched by the July 2026 Phase 2 suspension - that pause pulled third-party certification at Levels 2 and 3, and Level 1 never had a third party in the loop.

What "expired" actually costs you

An affirmation isn't a formality you can let slide until someone asks. When it lapses, you're no longer showing an active, compliant posture in SPRS. In practice that means:

• You can fall out of eligibility for contracts and task orders that require an active Level 1 status, without any notice that it happened.
• Your prime can flag it. Many primes check SPRS posture on their subs, and an expired affirmation reads the same as never having one.
• A stale affirmation is still a legal statement. The affirmation is a senior official's attestation to the government. Signing one that isn't accurate - or leaning on one that's a year out of date while your environment has drifted - carries real exposure. This is why the honest version matters more than the convenient one.

The fix is boring and cheap: know your date, redo the assessment before it, re-affirm on time.

How to find your date

Your affirmation date is whatever day the current one was entered in SPRS. If you affirmed when you first submitted a score, that's your anchor, and you're due about a year later.

If you're not sure when that was, log into SPRS and check the date on your current affirmation. That's the number that matters. Set a reminder for 60 days ahead of it - not the day of - because the re-assessment and any access renewals take longer than you'd think.

What to line up before you re-affirm

Treat renewal like a smaller version of the first time, not a rubber stamp.

1. Re-run the assessment against today's environment, not last year's. Shops change. You added a laptop, swapped an MSP, moved files to a new share. Any of those can turn a "met" into a gap. Re-scoring against what's actually true now is the whole point. The free 5-question check is a fast way to spot-check whether anything slipped.
2. Refresh your evidence. The artifacts that backed last year's score should still exist and still match reality. Here's what counts as evidence - it's practice records, not activity logs, and Level 1 has no audit-logging requirement.
3. Confirm your SPRS access still works. SAM registration, PIEE, and the affirming official's role approval can all expire or need renewal on their own schedules. Finding out the week you need to submit is how a one-day task becomes a two-week scramble. The SPRS submission walkthrough has the sequence.
4. Fix any new gaps before you sign. If the re-assessment surfaces something, close it first. An affirmation is a statement that you meet the requirements now, not that you plan to.

The two dates worth putting on the wall

• Your next contract event. Award, renewal, or option period. That's when a prime or a contracting officer is most likely to look.
• Your affirmation anniversary, minus 60 days. That's when re-assessment work should start, so the new affirmation is in before the old one lapses.

If you got your first affirmation in during the initial CMMC rollout, your renewal is closer than the calendar makes it feel. There's a companion guide on exactly that: affirmed when enforcement started? yours is coming due.

Sources

32 CFR Part 170; FAR 52.204-21; NIST SP 800-171A; DoD CMMC Assessment Guide, Level 1.