{
 "slug": "affirmation-evidence-standard",
 "topic_id": "TOPIC-199",
 "cluster": "Defense Industrial Base, CUI & Export-Control Identity",
 "tier": "Tier A",
 "title": "CMMC Phase II is suspended. The affirmation still has your name on it.",
 "summary": "The Department announced immediate suspension of CMMC Phase II requirements on 13 July 2026. The annual affirmation, signed by a named company official, and the False Claims Act exposure behind it, did not go away.",
 "lede": "The suspension relieved contractors of third-party certification. It did not touch the part with teeth: a named official personally affirms that the company meets its cybersecurity requirements, and a false affirmation is a False Claims Act problem.",
 "date": "2026-01-30",
 "category": "Compliance",
 "author_id": "solene-beaumont-adjei",
 "tags": [
  "CMMC",
  "annual affirmation",
  "False Claims Act",
  "DFARS",
  "NIST 800-171",
  "defense contractor"
 ],
 "image_title": "Affirmation Evidence Standard",
 "schema": "Article",
 "key_takeaways": [
  "The Department announced immediate suspension of CMMC Phase II requirements on 13 July 2026. Safeguarding obligations and the affirmation requirement were not suspended.",
  "Cybersecurity False Claims Act settlements continued through 2026, including a June 2026 settlement over unmet safeguarding requirements.",
  "FCA damages scale with contract value, not with the size of the security gap, which is why the affirming official's personal exposure is disproportionate to the control deficiency."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The morning the suspension landed"
  },
  {
   "type": "diagram",
   "kind": "compare",
   "alt": "What the suspension changed and what it did not",
   "caption": "The assessment cadence moved. The personal statement did not.",
   "nodes": [],
   "left": {
    "title": "Suspended",
    "items": [
     "Phase II assessment requirements",
     "Associated timelines",
     "Certain contractual triggers",
     "Programme sequencing"
    ]
   },
   "right": {
    "title": "Unchanged",
    "items": [
     "The annual affirmation",
     "A named official signs it",
     "False Claims Act exposure",
     "What you must be able to evidence"
    ]
   }
  },
  {
   "type": "p",
   "html": "A compliance lead at a second-tier supplier described the reaction as relief followed, about two hours later, by a different feeling."
  },
  {
   "type": "p",
   "html": "The relief was straightforward: a third-party assessment they had budgeted for and dreaded was off the table. The second feeling arrived when their counsel pointed out that the annual affirmation was unchanged, that the CEO signs it, and that nothing in the company could reconstruct what last year's affirmation had been based on."
  },
  {
   "type": "h2",
   "text": "What changed and what did not"
  },
  {
   "type": "table",
   "head": [
    "Element",
    "Status after 13 July 2026"
   ],
   "rows": [
    [
     "Third-party CMMC assessment (Phase II)",
     "Suspended"
    ],
    [
     "DFARS safeguarding clause obligations",
     "Unchanged"
    ],
    [
     "NIST SP 800-171 implementation expectations",
     "Unchanged"
    ],
    [
     "SPRS scoring",
     "Unchanged"
    ],
    [
     "Annual affirmation by a named official",
     "<strong style=\"font-weight:600\">Unchanged</strong>"
    ],
    [
     "False Claims Act exposure for a false affirmation",
     "<strong style=\"font-weight:600\">Unchanged</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The row that mattered to the CEO is the last two. Suspension removed the verification mechanism and left the personal attestation in place, which is arguably a worse configuration than either extreme."
  },
  {
   "type": "h2",
   "text": "Why FCA exposure is disproportionate"
  },
  {
   "type": "p",
   "html": "This is the part that changes how seriously a company treats it, and it is frequently misunderstood."
  },
  {
   "type": "p",
   "html": "False Claims Act damages are computed from the value of the contracts affected, and may be trebled, with per-claim civil penalties on top. They are not computed from the cost of the controls that were missing."
  },
  {
   "type": "p",
   "html": "A supplier with a modest security gap on a large contract portfolio faces exposure orders of magnitude larger than the remediation would have cost. Cybersecurity FCA settlements continued through 2026, including a June 2026 settlement of $507,144 — including restitution — resolving potential liability over unmet safeguarding requirements."
  },
  {
   "type": "blockquote",
   "text": "The penalty scales with what you sold, not with what you failed to secure."
  },
  {
   "type": "h2",
   "text": "What the affirming official is actually attesting to"
  },
  {
   "type": "p",
   "html": "In practice, a spreadsheet. Control scores maintained by whoever had time, a system security plan written by a consultant eighteen months ago, and a plan of action with items whose closure dates have slipped."
  },
  {
   "type": "p",
   "html": "Ask the affirming official to reconstruct, today, what the control state was on the date of last year's affirmation. In most companies that reconstruction is not possible, because the spreadsheet has been edited in place."
  },
  {
   "type": "h2",
   "text": "The Affirmation Evidence Standard"
  },
  {
   "type": "p",
   "html": "Make the affirmation a signature over an immutable control-state record."
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"cybersecurity_affirmation\",\n  \"render\": [\n    \"Entity: [name, CAGE, UEI]\",\n    \"Scope boundary: [systems in scope, hash of the boundary document]\",\n    \"Control state: [hash of the scored control set]\",\n    \"Score: [value]  Method: [assessment basis]\",\n    \"POA&M: [open item count, hash of the plan]\",\n    \"Basis: [self-assessment | third party | joint surveillance]\"\n  ],\n  \"affirming_official\": \"[credential assertion, title]\"\n}"
  },
  {
   "type": "p",
   "html": "A year later, the official can state precisely what they affirmed, and a prime or an investigator can verify it without access to the company's systems."
  },
  {
   "type": "h2",
   "text": "What a prime gets"
  },
  {
   "type": "p",
   "html": "Primes flow safeguarding requirements down and currently verify compliance by collecting attestations. A supplier able to produce a verifiable control-state record at each affirmation gives the prime something it can sample rather than file."
  },
  {
   "type": "p",
   "html": "That is worth raising in supplier negotiations now, during the suspension, precisely because the assessment mechanism that would otherwise have provided assurance is unavailable."
  },
  {
   "type": "h2",
   "text": "What this is not"
  },
  {
   "type": "p",
   "html": "It does not deliver CMMC compliance, does not substitute for implementing NIST SP 800-171, and does not provide legal advice about FCA exposure. It addresses one narrow question: what can the affirming official demonstrate about the basis for their signature."
  },
  {
   "type": "p",
   "html": "For a person whose personal exposure is trebled damages on a contract portfolio, that question is worth an afternoon."
  },
  {
   "type": "h2",
   "text": "What an affirmation actually asserts"
  },
  {
   "type": "p",
   "html": "That the organisation meets stated requirements, signed by a named individual on the organisation's behalf. The exposure is personal and organisational, and it does not depend on whether an assessment was scheduled. A suspension changes when someone checks; it does not change whether the statement was true."
  },
  {
   "type": "table",
   "caption": "Evidence for the claims most often affirmed",
   "head": [
    "Claim",
    "What evidences it"
   ],
   "rows": [
    [
     "Access is limited to authorised users",
     "Per-access records naming individuals"
    ],
    [
     "Privileged functions are logged",
     "Records the privileged party cannot write"
    ],
    [
     "CUI is protected across boundaries",
     "Receipts that verify without the subcontractor"
    ],
    [
     "Changes are authorised",
     "Signed approvals bound to the change"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“We can affirm now and fix it before assessment.”</strong> The affirmation is a present statement. If it is inaccurate when signed, a later remediation does not make it accurate then."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The suspension signals the requirements are going away.”</strong> Programme sequencing changed. Safeguarding obligations flow from contract clauses that did not."
  }
 ],
 "faq": [
  {
   "q": "Did the suspension remove the affirmation requirement?",
   "a": "The announcement addressed Phase II assessment requirements. Safeguarding obligations and the affirmation requirement were not suspended, and contractors should confirm the current position with counsel."
  },
  {
   "q": "Who should be the affirming official?",
   "a": "A senior official with authority to bind the company, as specified in the programme requirements. In smaller suppliers this is frequently the CEO."
  },
  {
   "q": "Does a signed control-state record reduce FCA risk?",
   "a": "It evidences the basis for the affirmation. It does not alter the legal standard and this article gives no legal advice."
  },
  {
   "q": "Is this worth doing while the programme is suspended?",
   "a": "The affirmation continues and the assessment that would have corroborated it does not. That combination arguably increases the value of independent evidence."
  },
  {
   "q": "Did the July 2026 suspension remove the affirmation?",
   "a": "No. It suspended Phase II requirements. The annual affirmation and the personal exposure behind it remain."
  },
  {
   "q": "Who bears the exposure?",
   "a": "The named official who signs, alongside the organisation. That is what makes the evidence question personal."
  },
  {
   "q": "What is the cheapest gap to close?",
   "a": "Per-access records naming individuals, and signed change approvals — together they evidence several of the most commonly affirmed claims."
  }
 ],
 "sources": [
  {
   "t": "CMMC program — DoD CIO",
   "u": "https://dodcio.defense.gov/CMMC/"
  },
  {
   "t": "U.S. Department of Justice — press releases",
   "u": "https://www.justice.gov/news"
  },
  {
   "t": "NIST SP 800-171 Rev. 3 — Protecting CUI",
   "u": "https://csrc.nist.gov/pubs/sp/800/171/r3/final"
  },
  {
   "t": "32 CFR Part 117 — National Industrial Security Program Operating Manual",
   "u": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117"
  }
 ],
 "related": [
  {
   "slug": "interim-supplier-assurance",
   "title": "Buying identity assurance when CMMC is paused",
   "category": "Compliance"
  },
  {
   "slug": "cross-boundary-cui-access",
   "title": "Who touched the CUI?",
   "category": "Compliance"
  },
  {
   "slug": "software-attestation-evidence",
   "title": "The secure software development attestation",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Affirmation%20Evidence%20Standard/1200_630/blog.jpg",
 "wordcount": 936,
 "url": "/blog/affirmation-evidence-standard.html",
 "reading_time": "4 min read",
 "seo_title": "CMMC Phase II is paused. The affirmation is not.",
 "meta_description": "CMMC Phase II requirements were suspended in July 2026. The annual affirmation, signed by a named official, and its liability remain.",
 "hub": {
  "slug": "topics/dib-identity",
  "title": "Defense industrial base identity"
 },
 "answer": "No. The Department announced immediate suspension of Phase II requirements on 13 July 2026. The annual affirmation, signed by a named company official, and the False Claims Act exposure behind it, did not go away — and an affirmation is a personal statement about facts you either can or cannot evidence.",
 "answer_q": "Does suspending CMMC Phase II remove the affirmation risk?",
 "glossary": [
  {
   "term": "Affirmation",
   "def": "A signed statement by a named company official that the organisation meets stated cybersecurity requirements."
  },
  {
   "term": "False Claims Act",
   "def": "The statute under which inaccurate statements made to obtain government funds can create liability, including for individuals."
  },
  {
   "term": "Safeguarding clause",
   "def": "The contract term imposing protection requirements, which operates independently of assessment programme timing."
  }
 ],
 "checklist": {
  "title": "Preparing an affirmation you can defend",
  "id": "affirm",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "List the specific claims the affirmation makes.",
    "text": "Not the framework — the sentences."
   },
   {
    "name": "For each, name the artefact that evidences it.",
    "text": "If the artefact is a policy, that is a gap."
   },
   {
    "name": "Have the signing official review the gaps.",
    "text": "They are the one exposed."
   },
   {
    "name": "Close the cheapest gaps first.",
    "text": "Per-access records and signed change approvals are usually the cheapest and cover the most claims."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising individual to the exact access or release being authorised, and produces a receipt a prime, a government customer or an investigator can verify without access to the contractor's systems.",
  "href": "../docs.html",
  "label": "See access receipts"
 }
}