Give each responsibility its own owner
A Level 1 self-assessment evaluates the applicable requirements for the defined scope. The affirmation is the authorized senior official's statement of continuing compliance. These are connected, but an assessment entry should not be assumed to complete the affirmation automatically. The annual cycle needs both.
32 CFR 170.15 requires the annual Level 1 self-assessment and submission of results in SPRS. Section 170.22 describes the Affirming Official and the electronic affirmation. Assign an assessment coordinator, technical contributors, and the senior official early enough that the final step is informed rather than rushed.
Work backward from the review date
A practical internal calendar might reserve several weeks for checking scope and system changes, then time for demonstrations and corrective actions, followed by an assessment review meeting. This is an example of project planning, not a prescribed government schedule or a promise that every company can prepare within that period.
Place reminders in a shared business calendar and add a backup person. Keep the actual status and dates from SPRS as the authoritative record. Do not infer a current status from the date someone last edited a spreadsheet or from a prior year's email saying that the task was complete.
Prepare a concise briefing for the official
Explain the scope, what was reviewed, the result, how unresolved questions were handled, and what operational changes could affect ongoing implementation. Provide access to underlying supporting records through the company's controlled process. The official should be able to ask about exceptions and understand the basis for the statement.
The Affirming Official is a senior representative inside the organization with the required responsibility and authority. An external adviser can prepare materials, but should not be treated as a substitute for the organization's authorized official. Confirm the proper SPRS access and workflow before the due date.
Maintain the safeguards between annual events
An annual calendar is a minimum management rhythm, not permission to leave a broken safeguard unresolved for the rest of the year. Integrate personnel departures, device retirement, software changes, visitor access, and new external connections into routine operations. Escalate significant changes to the people responsible for the assessment and affirmation.
After submission, verify both records in SPRS and preserve an internal note of what was confirmed and when. Limit any status claims made to customers to the actual scope and current record. The organization remains responsible for an accurate statement even when a consultant, platform, or IT provider helped prepare the work.