Track CMMC certification, affirmation, and SPRS dates

1. What is CMMC?

CMMC — the Cybersecurity Maturity Model Certification — is the Department of Defense framework requiring contractors that handle federal contract information or controlled unclassified information to demonstrate a required level of cybersecurity in order to be eligible for DoD contracts. The level is tiered to the contract and the data involved, with lower levels commonly met by self-assessment and higher ones requiring a third-party assessment. Eligibility is then held in place by an ongoing yearly affirmation and by supporting documents that have to stay current. Remindax helps you track those dates and reminds you before each. It does not assess, certify, remediate, or manage cybersecurity, and it is not a GRC platform or an authorized assessor.

The part worth sitting with is who decides. Nothing about your company determines your obligation on its own — not your headcount, not your revenue, not the sensitivity you'd assign to your own systems. The requirement arrives attached to an opportunity, and it can arrive at a different height each time. That makes CMMC a forward-looking obligation in a way most dated records aren't: the useful question isn't "is our certification current?" but "will we be at the level the next thing we want to bid on asks for, by the time it asks?"

1.1 What keeps you eligible

Four things carry dates, and only the first looks like a certificate:

• →The certification level — tiered to the contract and the information it involves. Lower levels are commonly self-assessed; higher levels generally call for a third-party assessment, which has to be scheduled rather than simply performed.
• →Assessment validity — a CMMC assessment commonly carries a multi-year validity, around three years, after which it has to be redone rather than extended.
• →The annual affirmation — a yearly submission by a named senior official confirming that the requirements are still being met in between assessments.
• →Supporting documents — the System Security Plan, any POA&M items with close-out deadlines, and the score posted in SPRS.

Each is governed by rules that are still phasing in, so treat every specific here as a starting point for a conversation with your assessor rather than a settled fact. What isn't likely to change is the structure: a level someone else chooses, a certification obtained on a long lead time, and a set of records underneath it that have to keep saying true things about an environment that keeps moving.

2. Does CMMC certification expire?

So a CMMC certification expiration date is a real thing you can write down — it just isn't the only date that decides whether the certification still counts for anything. The distinction that matters here is between a validation and an affirmation, because they do different jobs. An assessment is the event that produces the certification — the examination itself, at the level required, self-performed or assessor-led depending on where you sit. The annual affirmation isn't a smaller version of that. It's a signature: a named senior official personally stating that a certification already in hand still describes reality. Nobody re-examines anything. Somebody takes responsibility for the claim.

That's why the yearly date is the one that slips. The assessment is expensive, scheduled far ahead, and owned by a project team — it has everyone's attention by construction. The affirmation is one submission by one person on a date that arrives without ceremony, in a year when nothing else about CMMC is happening. It looks administrative, and it's the thing standing between a certificate and its meaning. A contractor holding a certification that hasn't expired can still find its position weakened because the signature that was supposed to accompany it never went in.

3. Why tracking CMMC dates matters

Four properties combine to make this an unusually easy obligation to be quietly wrong about:

Individually, none of these is hard to handle. Together they produce a specific and recognizable failure: the contractor who is genuinely compliant, believes it, and is right — for the contract it happens to be performing. Everything on the current job is in order. The certification hasn't expired. And the reason a bid didn't go anywhere last quarter never quite gets traced back to a level, a lapsed affirmation, or a score that hadn't been refreshed since the environment changed. Nothing announced itself, so nothing got fixed.

4. Who needs to track CMMC dates

The dates are usually split across people who don't share a calendar, which is most of the problem:

Defense contractors

Businesses in the defense industrial base holding a level for the contracts they perform — and needing a higher one before they can chase the contracts they want next.

Learn More

Subcontractors to primes

Obligations arrive second-hand, passed down from a prime's contract — so the level required can be decided two steps away from anyone who works there.

Learn More

IT & security leads

The people who own the System Security Plan and the POA&M items, and who find out last that a new pursuit has changed what the company is expected to hold.

Learn More

Capture & proposal teams

The first people to read what a solicitation demands — and the ones who need the answer months before the deadline, when a gap could still have been closed.

The affirming senior official

One named person carries the yearly submission personally. It's the only date on this page that can't be delegated to whoever happens to be free that week.

Multi-entity organizations

Where separate business units or enclaves each carry their own level, assessment date, and affirmation — and one unit's standing says nothing about another's.

Learn More

The recurring pattern is a handoff that never happens. Capture reads a requirement and files it as a bid consideration. IT owns the environment and the plan describing it. One executive owns a signature. Nobody owns the sentence that would join them — "the thing we intend to pursue in the spring needs a level we don't currently hold, and getting there starts now." That sentence only exists if the dates and the level live somewhere both sides look.

5. What happens when a CMMC date lapses

Nobody tells you. That's the whole difficulty, and it's worth stating plainly because it's so unlike the way compliance failures usually behave. An expired permit stops work. A failed inspection tags out a machine. A lapsed professional license means somebody can't sign something, today, and everyone finds out immediately. A CMMC shortfall produces none of that. Your systems keep running, your current contract keeps being performed, your staff keep working, and no notice arrives to say a threshold was crossed.

What changes is what you're allowed to go after. Because the requirement is written into individual solicitations, falling short doesn't remove you from the market — it removes you from a subset of it, and the subset is invisible from where you're standing. Opportunities you'd have been competitive for simply aren't ones you can pursue. There's no rejection letter for a bid you never submitted, and no line item anywhere in the business for revenue that never had the chance to exist. A defense-focused company can lose a meaningful part of its addressable pipeline this way and experience it only as a slow quarter.

The specific ways it happens are unglamorous. A certification runs to the end of its multi-year validity and the reassessment wasn't booked early enough, so there's a gap between one and the next. The annual affirmation date passes in a quiet year and the certification carries on looking valid while quietly resting on nothing. The SSP still describes an environment the company has since moved off. A POA&M item's close-out deadline arrives with the item not closed. Or the SPRS score reflects a posture from before the last round of changes — and because a prime or a contracting officer can read that directly, it's the one failure that speaks for you in your absence.

And the recovery is slow in a way the calendar doesn't warn you about. A gap discovered inside a bid window generally can't be closed inside that bid window — a third-party assessment isn't something you can arrange because a deadline is pressing. That inverts the usual logic of a renewal reminder. Knowing the date something expires is useful. Knowing it early enough to have done something about it is the entire point.

6. How Remindax keeps your CMMC dates current

Your security team and your assessor do the work; your senior official signs the affirmation. What's left over is a coordination problem — knowing what's due, who owns it, and getting warned early enough that a long lead time is still available to you. That's the part Remindax does:

7. Why spreadsheets fail for CMMC tracking

A spreadsheet built to hold CMMC compliance dates almost always contains one row: the certification and the date it runs out. That row is the least dangerous thing on the whole list. It's the expensive, scheduled, project-managed item that nobody was going to forget anyway — and having captured it, the tracker feels complete.

What it leaves out is everything that actually goes wrong. It has no row for the yearly affirmation, because an affirmation isn't a document with an expiry printed on it. It has no way to hold a POA&M close-out deadline, or to know that the SSP no longer matches the environment, or that the posted score is older than the last three changes to the network. And it certainly has no column for the requirement that hasn't arrived yet — the level a pursuit in next year's plan is going to ask for, which is the only entry that would have given anyone time to act.

Then there's the silence. A spreadsheet will hold a date perfectly and never once mention that it passed. For an obligation whose failure mode is already invisible — where nothing stops, nobody writes, and the cost is work you never got to bid on — a silent tracker isn't a partial solution. It's a second layer of the same problem.

8. Key takeaways

• ✓CMMC gates eligibility for DoD contracts involving protected information — and the level required is set by the contract, not by anything inside your own business.
• ✓That makes it a forward-looking obligation: the bar is defined by opportunities you haven't won yet, and can differ between two pursuits in the same quarter.
• ✓A CMMC assessment commonly carries a multi-year validity, while a yearly affirmation by a named senior official is what keeps an issued certification meaningful in between.
• ✓The SSP, POA&M close-out deadlines, and the SPRS score carry their own dates — and the posted score is the part a prime or contracting officer can read without asking you.
• ✓A shortfall produces no notice and no stop-work; it just narrows what you can pursue, and it can't be fixed inside a bid window — so warning has to arrive with runway. Remindax tracks the dates; it doesn't assess, certify, or remediate.