SPRS and CMMC: Prepare the Assessment and Affirmation Handoff

Separate the work into three decisions

First, decide which assessment and system boundary apply. Second, complete and support the assessment result. Third, identify the company official responsible for the affirmation. Mixing these steps can leave a team with completed consulting work but an incomplete submission or an official who has not reviewed the basis for the statement.

Build a handoff packet before opening the portal

• A plain-language scope summary with a version date.
• The relevant organization and CAGE-code information.
• The assessment result and the supporting review record.
• An index of the retained evidence in its approved repository.
• The responsible submitter and the authorized affirming official.
• A calendar and owner for ongoing maintenance.

Use a short cover sheet to identify missing items. A handoff should make uncertainty visible. Do not hide unresolved gaps in an appendix while presenting a final-looking result on the first page.

Know what the affirmation represents

Under 32 CFR 170.22, the affirming official is a senior representative within the organization with responsibility and authority for the compliance statement. Affirmations are entered in SPRS after the applicable assessment and annually thereafter. A consultant’s review does not substitute for the organization’s own accountable official.

Before the handoff, hold a leadership briefing. Explain the scope, basis for the result, continuing responsibilities, and any changes that would call the underlying assumptions into question. Ask the official to raise questions while there is still time to investigate them.

A score and a current CMMC status are different checks

For covered contracts, DFARS 252.204-7021 describes CMMC status, system-specific identifiers, assessment reporting, and current affirmations. Avoid using an older score, a screenshot of a different system, or a service invoice as proof that every required CMMC step is complete. Match the record to the actual contractual requirement.

Verify the result in the system of record

After authorized company personnel submit, read back the relevant record and check the organization, scope, level, dates, and affirmation. Record who verified it and when. Keep the confirmation with the assessment documentation under the organization’s access and retention rules.

This guide does not provide a screen-by-screen portal procedure. Portal roles and interfaces can change. Use the official SPRS instructions for the current workflow and obtain the right organizational access before the deadline.

Maintain the next cycle

Assign a business owner for the recurring review and a technical owner for reporting significant environment changes. Schedule internal checkpoints early enough to resolve issues. Federal Bid Partners (FBP) can be contacted about readiness support; explore CMMC Pulsar for the supporting preparation workflow. Neither a software export nor a consulting deliverable is itself a verified SPRS submission.

Common questions