The assessment is a snapshot; the affirmation is not
Passing an assessment shows your environment met the requirements on the days it was assessed. The affirmation your senior official submits says something bigger: that you have implemented the requirements and will maintain them. It is repeated every year.
The DFARS CMMC clause (252.204-7021) also requires you to keep a current CMMC status at the required level for the whole time you perform the contract.
So staying compliant is not an event every three years. It is a set of things that have to keep happening.
Your calendar
- Level 1: a self-assessment and an affirmation every year.
- Level 2: an assessment (self or C3PAO, as your contract requires) every three years, with an affirmation every year in between.
- Conditional status: any POA&M items must be closed within 180 days, followed by a new affirmation.
- Contract milestones: contracting officers check SPRS before awards and before exercising option periods. A lapsed status at the wrong moment can stop an option from being exercised.
Plan your reassessment well before your status expires. C3PAO schedules can fill up, and you want time to fix anything a pre-assessment review finds.
What has to keep happening
Many NIST SP 800-171 requirements are activities with an implied or chosen frequency. Typical recurring work includes:
- Reviewing user accounts and privileges, and removing access promptly when people leave or change roles.
- Reviewing audit logs and acting on what they show.
- Security awareness training for all users, plus role-based training.
- Vulnerability scanning and fixing what the scans find.
- Risk assessments, repeated periodically.
- Testing your incident response capability.
- Assessing your security controls periodically, and updating your plan of action.
- Reviewing and updating your System Security Plan.
For each one, write down how often you do it, who does it, and what record it leaves. Those records are your evidence that the affirmation is true.
Changes that can break compliance
- People change. The person who ran the quarterly access review leaves, and the review quietly stops.
- Systems change. A new laptop, a new cloud service, or a new office can sit outside your documented scope while handling CUI.
- Providers change. A new IT provider needs to be in your SSP, with a responsibility matrix.
- Contracts change. A new contract may require a higher level, or bring CUI into an environment that only handled FCI.
- Subcontractors change. If you flow CUI or FCI down, your subcontractors need the matching CMMC status too.
Making it routine
- Give every recurring activity an owner and a due date, and track them somewhere everyone can see.
- Keep evidence as you go, dated and organized by requirement. See Evidence basics.
- Hold a short review before each annual affirmation: what changed, what slipped, and whether the SSP still matches reality.
- Treat a missed activity as a finding: record it, fix it, and if your score changed, update SPRS.