The Department of Defense's CMMC framework requires a specific person to take responsibility as the Affirming Official. Choosing who fills this role is one of the most critical decisions your organization will make in the next contracting cycle.
For many defense contractors, the default choice seems to be the CISO. After all, who better to attest to cybersecurity compliance than the executive responsible for it? But this decision has implications that go beyond organizational logic. Let's examine both sides.
The Role of the Affirming Official
Over 300,000 organizations in the defense ecosystem must designate an Affirming Official to attest annually to their compliance status. This person faces False Claims Act liability, with potential fines exceeding $250,000 per violation, if they knowingly submit false attestations through the Supplier Performance Risk System.
The role requires authority to direct CMMC implementation across technical systems, personnel training, and budget allocation. It's not just about signing a form; it's about bearing the legal and operational weight of continuous compliance across 100+ controls spanning 14 domains.
Why Your CISO Might Be the Right Choice
Your CISO is deeply familiar with security architecture. They understand the technical requirements of NIST SP 800-171, can evaluate your implementation of access controls, and know when a compensating control is valid.
CISOs have direct visibility into your security posture. They review vulnerability scan results, incident response metrics, and patch management timelines. When your Affirming Official needs to attest that controlled unclassified information is properly protected, your CISO already knows the status.
The role aligns with existing CISO responsibilities. You're already asking them to manage risk, implement controls, and report on security posture. Adding CMMC attestation extends that accountability logically.
Practically, your CISO is the person who'll be in the room when the C3PAO auditor asks detailed questions. They understand the evidence requirements, know where gaps exist, and can make informed decisions about Plans of Action and Milestones.
Why Your CEO or COO Might Be Better
CMMC isn't just a technical framework. It's a business-critical requirement affecting procurement, contracts, HR policies, facility access, supply chain relationships, and budget allocation. Your CISO controls security tools, but they don't control whether Sales expands your CUI footprint faster than Security can scale, or whether Finance approves the budget for monitoring tools.
The Affirming Official needs authority to make cross-functional decisions and enforce compliance even when it conflicts with other business priorities. Consider what happens when Engineering wants to use a non-compliant cloud service, or when a major customer demands access to systems containing CUI. Your CISO can recommend against it, but can they stop it?
Recent False Claims Act settlements highlight the stakes. TRICARE paid $11.2 million for failing to perform continuous monitoring duties. MORSECORP settled for $4.6 million over a false SPRS score. Georgia Tech paid $875,000 for submitting inaccurate attestations. These weren't just security failures, they were organizational failures where security requirements lost to other priorities.
When the Civil Cyber-Fraud Initiative comes knocking, "reckless disregard for the validity of information" can trigger liability. Your Affirming Official can't claim ignorance of a gap if they lacked the authority to fix it. That's a governance problem.
Current Practices
Most mid-sized defense contractors name their CISO or equivalent security director as the Affirming Official. Larger organizations often split the responsibility: the CISO handles technical implementation and audit preparation, while the CEO or COO signs the attestation after a formal recommendation from Security.
This hybrid approach acknowledges that technical expertise and organizational authority don't always reside in the same person. Your CISO builds the compliance program, but your CEO ensures it gets the necessary resources and commitment.
Some organizations establish governance structures around the attestation process, quarterly reviews where Security presents evidence to an executive committee, formal sign-offs from department heads, and documented escalation paths for unresolved risks. The goal is to ensure the Affirming Official bases their attestation on verified evidence.
Our Recommendation
Your CISO should be the Affirming Official if, and only if, they have genuine authority to enforce compliance across your organization. If your CISO can halt a project that violates security requirements, redirect budget to address gaps, and escalate to the board without multiple approvals, they're positioned to own this responsibility.
But if your CISO is merely an advisor whose recommendations can be overruled, you're setting them up for liability over decisions they don't control. That's unfair to them and doesn't serve your compliance program.
The real question isn't who has the title, but who has the power. Your Affirming Official needs to be the person who can say "no" to a contract if security isn't ready, demand POA&Ms get closed before deadlines, and tell the board you're not ready to attest, even if it delays revenue.
If that's your CISO, name them. If it's not, elevate their authority or designate someone higher up who can make binding decisions. CMMC doesn't care about your org chart. It cares whether the person attesting can deliver what they're promising.
