How to Maintain CMMC Compliance After Certification
By Shaheer Malik · Updated Oct 28, 2026
To keep a CMMC status, your Affirming Official must affirm continuing compliance in SPRS every year, you must reassess on schedule (yearly for Level 1, every three years for Levels 2 and 3), and you must keep meeting the requirements in between. Contracting officers check SPRS again before exercising an option or extending a contract.[1][2]
The yearly cycle
- Affirm. After each assessment, after any POA&M closeout, and annually; the affirmation states that you “ha[ve] implemented and will maintain implementation of all applicable CMMC security requirements.”[1]
- Reassess. Level 1 every year; Level 2 (Self), Level 2 (C3PAO) and Level 3 every three years.[1]
- Keep evidence. Artifacts used as evidence must be kept for six years from the CMMC Status Date.[1]
Why it matters mid-contract
Contracting officers must check SPRS and may not exercise an option or extend the period of performance unless your status is current at the required level.[2] A status remains current only if there have been no changes in compliance with the requirements since the status date.[2]
When your environment changes
New offices, systems, cloud services or providers that touch CUI change your assessment scope. Update the System Security Plan, asset inventory and network diagram, and check whether the change affects compliance before the next affirmation. If you use new CMMC UIDs for additional systems, contracting officers check those in SPRS too.[2]
Habits that make affirmations easy
- Review the SSP and POA&M quarterly, not once a year.
- Track evidence as you go: access reviews, patching, training, incident drills.
- Recheck scope whenever IT, HR or facilities change.
Many companies keep a consultant or MSP on retainer for this. Find CMMC consultants or read CMMC for MSPs.
FAQ
Do I need to affirm CMMC every year?
Yes. An Affirming Official must affirm continuing compliance in SPRS after every assessment, after any POA&M closeout, and annually.
How long must I keep CMMC evidence?
Six years from the CMMC Status Date.
What happens if my CMMC status lapses mid-contract?
Contracting officers must check SPRS before exercising an option or extending performance, and may not do so without a current status at the required level.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
More on getting certified
- CMMC Certification Cost: What Level 2 Costs in 2026
- CMMC Level 2 Assessment: How a C3PAO Certifies You
- How to Get CMMC Certified: 9 Steps for 2026
- How Long Does CMMC Certification Take?
- What Defines the Scope of a CMMC Assessment?
- CMMC POA&M Rules and Conditional Status Explained
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.