Does the tracker check the subcontractor's answer?

No. It records what each subcontractor declares and reads the published rule against the dates. It does not look anything up in SPRS, verify a score or assess anyone; a finding is a date to chase or a question for the subcontracts lead.

Findings · finding 8 of 12

Subcontractor CMMC assessment or affirmation expiring in 90 days

The SPRS assessment, the CMMC status, the affirmation or the POA&M window lapses within 90 days of the as-at date. Ninety days is a window this register sets for chasing, not a legal deadline.

What the register reads

a date to chase

Chase the renewal before the date shown.

The rule sentences behind it

4 cited

DFARS 252.204-7021, "current" (2)(ii)codified text, eCFR current to 24 Sep 2026; the same text is carried in Class Deviation 2026-O0025, effective 1 Feb 2026

Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with (A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and (B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official

Threshold read: Final Level 2: not older than 3 years, affirmation not older than 1 year. Source

DFARS 252.204-7021, "current" (2)(i)codified text, eCFR current to 24 Sep 2026; the same text is carried in Class Deviation 2026-O0025, effective 1 Feb 2026

Not older than 1 year for Final Level 1 (Self), with (A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and (B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official

Threshold read: Final Level 1: not older than 1 year. Source

32 CFR 170.22(a)codified text, eCFR current to 24 Sep 2026

An Affirming Official from each OSA, whether a prime or subcontractor, must affirm the continuing compliance of their respective organizations with the specified security requirement after every assessment, including POA&M closeout, and annually thereafter.

Threshold read: affirmation after every assessment and annually thereafter. Source

32 CFR 170.21(b)codified text, eCFR current to 24 Sep 2026

The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180-days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within the 180-day timeframe, the Conditional CMMC Status for the information system will expire.

Threshold read: POA&M closeout within 180 days of the Conditional CMMC Status Date. Source

A line that raises it

invented

Saltmarsh Electronics | 1SE52 | 105 | 2023-12-01 | Level 2 (Self) | 2026-06-01 | yes | no | yes

See it in the specimen