When I owned our CMMC program as the compliance lead, the affirmation was the moment that changed how I thought about all of it. Up to that point it had felt like a technical project: evidence, screenshots, policies, checklists. Then it came time to actually sign, to put a name behind a statement to the federal government that said, plainly, this is true. That is a different kind of moment. It stops being an IT deliverable and becomes a question of whether the organization is ready to stand behind what it’s claiming.

I think about a company here, a composite of patterns that show up again and again. A thirty-person shop, a couple-million-dollar subcontract. Two years earlier someone had told them, you’re Level 1, fifteen controls, easy. So they self-assessed, the owner signed, and everyone moved on. Eighteen months later a former employee pointed out that three of those controls had gaps on the day they signed, and there was an email trail showing the company had known. The controls were never the problem. The signature was. They had put their name behind something the record didn’t support, and it cost them far more than getting it right would have.

Here’s the mistake, and it isn’t usually carelessness. It’s misunderstanding what the affirmation actually represents. It happens when the affirmation gets treated like paperwork, a form to complete and file, instead of what it really is: a business decision, a statement the whole organization has to be willing to stand behind.

Level 1 has fewer controls, not less accountability. It is genuinely simpler than Level 2: fifteen items instead of a hundred and ten, and no outside assessor. But the weight behind the signature is exactly the same. Fewer things to check. The same responsibility when you put your name to them.

A Level 1 self-assessment deserves the same discipline as any other decision the business makes, because your signature represents the organization, not the IT department.

The danger in Level 1 was never the fifteen controls. It’s that “simpler” quietly gets read as “lower stakes,” and the whole thing gets handed down to whoever runs IT and then filed away. Remember, no one outside ever checks your work at Level 1. There’s no C3PAO walking your floor. That isn’t a break. It means the discipline has to come from inside, from the business deciding it’s ready, not from an assessor forcing the question.

Yes, there’s a legal reality underneath all of this. A false affirmation is treated as a false claim to the government, and the penalties are serious enough that I don’t need to dramatize them. But executives don’t lie awake worrying about the finer points of the False Claims Act. They worry about something simpler and more human: putting their name on something they can’t defend. That’s the real risk here. It’s also the one you can do something about.

One thing I learned during certification is that the affirmation was never just an IT milestone. It was a business decision. IT gathered the evidence. Compliance validated it. Leadership decided whether the organization was ready to stand behind it. That’s exactly how it should work: the business decides, IT enforces. When the affirmation gets treated as a form for IT to submit, that structure quietly breaks, and the accountability ends up sitting with someone who was never meant to carry it.