Clear Path step · Business · Your industry's rules and risks
Keep the SSP, POA&M and SPRS score honest and current
Why it matters: The affirmation is a statement to the government. Overstating compliance creates legal risk far beyond any security gap.
On your path if you picked “Government contractor” for “What's your industry?”.
Do it
- Assess against the right level: FAR 52.204-21 practices for Level 1, NIST SP 800-171 for Level 2, and check whether your contracts accept a Level 2 self-assessment or require a third-party assessment.
- Record gaps honestly in a plan of action with dates.
- Update SPRS when your score changes.
- Brief the official who signs the affirmation on what is and isn't in place.
Check it worked: Your system security plan and plan of action are current, your SPRS score reflects reality, and a senior official signs the annual CMMC affirmation knowing what it covers.
Simply put
The affirmation is like signing a tax return: you're vouching that it's true. An honest plan of action with real gaps and dates is far safer than a score that looks better than reality.
In detail
The Department of Justice has pursued False Claims Act cases over misrepresented cybersecurity compliance; accuracy is the control.
Points toward the Long View: a compliance record you can stand behind at every annual signing.