The Affirming Official is the senior company representative who certifies the accuracy of a CMMC assessment. 32 CFR 170 requires each contractor to designate an Affirming Official and re-affirm compliance annually in the Supplier Performance Risk System (SPRS). The certification carries personal exposure under the False Claims Act.
Who can serve
The rule requires the Affirming Official to have the authority to affirm the organization's compliance. In practice, this is typically the CEO, CIO, CISO, or a senior executive with oversight of the security program. It is not a role that can be delegated to a compliance analyst. The individual must be able to stand behind every control statement.
What the certification covers
The Affirming Official attests that:
- Every NIST SP 800-171 Rev 2 control is either implemented or covered by a valid Enduring Exception with a functioning compensating control.
- The System Security Plan accurately describes the environment.
- Any Plan of Action and Milestones (POA&M) items meet the CMMC scoring thresholds and remediation deadlines.
- Evidence exists and can be produced on demand.
False Claims Act exposure
31 U.S.C. 3729 — the False Claims Act — creates liability for any false statement material to a federal contract payment. A CMMC affirmation is a statement of fact made to obtain or retain contract eligibility. The threshold is not intent to defraud. Reckless disregard or deliberate ignorance is sufficient.
Penalties include treble damages plus per-claim fines. The Department of Justice has pursued cybersecurity-related FCA cases under its Civil Cyber-Fraud Initiative since 2021. Settled cases have involved misrepresentation of NIST SP 800-171 compliance, audit log capture, and vulnerability remediation.
What this means for OT environments
Affirming Officials cannot sign for compensating controls they have not verified. For OT assets invoking Enduring Exceptions, the question is whether the compensating mechanism is technically deployed and produces usable evidence — not whether it is described in the SSP. A policy document without an operating control does not satisfy the affirmation.
Related terms
Access Gate connection
Access Gate produces the evidence — policy exports, session logs, audit records — that the Affirming Official needs to verify compensating controls for OT assets before signing. See CMMC Enduring Exceptions for OT.
