Skip to content

Help For suppliers

Compliance dates and reminders

When your next CMMC Level 2 self-assessment, SPRS posting, annual affirmation and POA&M closeout are due, by the rule, with email reminders before each.

Updated · Edwards Consulting Group

The Compliance dates page in your supplier console keeps the dates CMMC Level 2 (Self) runs on, works out what is due next, and emails your organization's admins before each date. These are Phase I dates: CMMC Phase II was suspended in July 2026, and self-assessments, SPRS posting and annual affirmations carry on; see the CMMC Phase II suspension.

What you enter

  • Your latest Level 2 self-assessment, or the next one you have planned.
  • When its score was posted in SPRS, or when you plan to post it.
  • Your latest annual affirmation in SPRS, if you have made one.
  • Your Conditional Level 2 (Self) status date, only if you hold one: the day the status began. It cannot be in the future.

Each is optional. The weekday and date you choose show beside each field. Press Save the dates to keep them; leave a date empty to clear it, and its reminders stop.

The Compliance dates page: the four dates, the deadlines worked out from them, the reminder schedule and the reminders sent so far
The Compliance dates page: the four dates, the deadlines worked out from them, the reminder schedule and the reminders sent so far

What Tiermark works out

The rules are the regulation's (32 CFR 170.16, 170.21 and 170.22):

DateWhen it is due
Next self-assessmentThree years after the later of your latest self-assessment and its posting in SPRS, or the date you have planned
SPRS postingThe date you have planned. If your latest self-assessment is newer than your latest posting, the page says it is not posted yet
Next affirmationA year after your latest posting or affirmation, whichever is later. Record each affirmation and the next moves a year on
POA&M closeout180 days after your Conditional status date
The Deadlines table with the next self-assessment, the next annual affirmation and the POA&M closeout, each with its date and days left, and under it the box naming the POA&M closeout deadline and the 180-day rule
The Deadlines table with the next self-assessment, the next annual affirmation and the POA&M closeout, each with its date and days left, and under it the box naming the POA&M closeout deadline and the 180-day rule

The closeout deadline. Under 32 CFR 170.21(b), a Conditional Level 2 (Self) status expires unless its POA&M is closed out within 180 days of the status date. When you enter your Conditional status date, the deadlines show the closeout date and how many days are left, and a box under them repeats the rule. Your plans of action themselves are kept in the self-assessment workspace; which requirements may be on one is in POA&M rules.

The reminders

Your organization's admins get an email:

  • 90, 30 and 7 days before the next self-assessment;
  • 7 days before a planned posting, and on the day;
  • 30 and 7 days before the next affirmation, and on the day;
  • 60, 30 and 7 days before the POA&M closeout deadline.

Each reminder is sent once. A reminder whose time had already passed when you entered the date is skipped, and the next one is sent. To stop a reminder, clear its date.

A closeout reminder's subject is "Compliance dates: POA&M closeout due" and the date. It says that your Conditional Level 2 (Self) status expires unless your POA&M is closed out by that day, cites 32 CFR 170.21(b), and links to the page.

Reminders are part of Supplier Pro. If the plan ends, they stop, and your dates stay on the page.

Who can change the dates

An admin or a contracts manager. Everyone in your organization can see them.

Tiermark reminds you; it does not post or affirm anything in SPRS. Your Affirming Official makes the affirmation in SPRS.

Still have a question?

Write to help@tiermark.io and a person will answer.