CMMC Certification Prep: Don’t Overlook the Affirming Official
Most defense contractors preparing for CMMC certification focus on technical controls for access management, encryption, and incident response. Those are undoubtedly crucial, but it’s important to remember there’s a person who has to put their name on all of it.
Who Is the CMMC Affirming Official?
CMMC language requires each certified organization to designate an affirming official: a senior leader who personally attests in the Supplier Performance Risk System (SPRS) that the organization has implemented and will maintain all required security controls. That attestation is required after every assessment and annually thereafter—and without a current one on file, a contractor cannot be awarded a covered contract.
CMMC CON 2026 Session: What the Role Really Requires
Michael Brooks, CMMC Strategy and Engagement Director at A-LIGN—one of only 104 authorized C3PAOs, according to the Cyber AB—will break down the affirming official role at CMMC CON 2026 on Sept. 23–24. Brooks brings a practitioner’s view of what the role actually requires, the legal weight behind it, and what a year-over-year support plan looks like once certification is in hand.
Legal Risk: False Claims Act and DOJ Civil Cyber-Fraud Initiative
The affirming official’s signature exposes them to personal liability under the False Claims Act, and the Department of Justice has already secured settlements worth millions through its Civil Cyber-Fraud Initiative for false or unsupported compliance claims. Yet many organizations assign the role late, brief the designee poorly, or fail to build the internal processes that keep them informed enough to sign with confidence each year.
Preparing for the Phase 2 Deadline and Annual Reaffirmation
For organizations approaching their first third-party assessment ahead of the Phase 2 deadline on Nov. 10, or preparing for their annual reaffirmation, this session offers a grounded look at one of the most consequential and least discussed parts of the CMMC program.
Register for CMMC CON 2026
Now in its seventh year, CMMC CON brings together C3PAOs, prime contractors, technology providers, and compliance practitioners. Register today to join Brooks and other industry leaders so you’re better prepared for the Phase 2 deadline.