Signer's File
What it is
The Signer's File (/proof/sign) is what an affirming official actually signs before submitting
an annual CMMC affirmation: the statement, the proof receipts behind it, what's still open
(POA&M items, exceptions), and what changed since the last file signed for this obligation — all
shown before the Sign button is ever reachable.
If your own records contradict the statement — a practice marked implemented with no fresh evidence behind it, an open POA&M item on a practice claimed as met, a stale self-assessment, and so on — signing is blocked until every contradiction is resolved. There is no "acknowledge and sign anyway" control anywhere on this page: a contradiction must be cleared one of three ways.
When to use it
Use it once your CMMC self-assessment is in good enough shape that you're ready to make the annual affirmation for real — the file is where you see exactly what you're about to attest to, and where CMDash checks it against your own records before letting you sign.
Before you start
- Tier: The Signer's File is included on every tier, FREE and up. A Free workspace is capped at 1 signed obligation (enforced by the product); a second framework or obligation is a reason to upgrade. See Free tier.
- Role: Any member can view an open draft. Starting a draft, signing, voiding a draft, and disclosing/narrowing a contradiction are OWNER/ADMIN only.
- Obligations available today: CMMC Level 1 and Level 2 affirmations — pick one from the tabs at the top of the page.
- Review status: each obligation's page shows a line stating where that obligation's exact wording stands in legal review.
How to
Open a draft
- Go to Signer's File (
/proof/sign) and pick the obligation tab (CMMC L1 or L2). - If a draft is already open (status Draft or Ready to sign), it loads automatically. Otherwise an Owner/Admin can start a fresh one.
- The draft shows: the exact statement text and its legal citation, the receipts cited behind it, open POA&M/exception counts, anything excluded from the statement (with the route that excluded it), and a What changed summary against the previous signed file for this obligation (receipts added/removed/changed; open items opened/closed).
Resolve a contradiction
Each contradiction lists the finding in plain language (for example, "AC.L1-3.1.1 is recorded as implemented, but no evidence for it is on file") plus the practice it targets. You clear it one of three ways:
- Fix it — a link to the page where the underlying record lives (a control's status, its evidence, an open POA&M item). Fix the record there, and the contradiction clears the next time the file recomputes.
- Disclose — records the gap as a new POA&M item or a new exception and takes the practice out of what the statement claims as implemented.
- Narrow — takes the practice out of the statement's claim directly, with a short written reason, without opening a POA&M item or exception.
CMMC Level 1 only offers Fix. 32 CFR § 170.15(a)(1) permits no POA&Ms for Level 1, and there is no narrower Level 1 status to affirm — every Level 1 finding must be fixed at the source, not disclosed or narrowed. If a stray POA&M item exists against a Level 1 practice, that alone is a contradiction (Level 1 permits none), and it must be completed or cancelled.
The Sign button stays disabled for as long as any contradiction remains open, whatever route you're working through.
Sign
- Once every contradiction is cleared, click Sign this file.
- You're asked to re-confirm your password or authenticator code — the same step-up used for API key and passkey changes — so a session left open on a shared machine can't sign on your behalf.
- Once signed, the file is frozen: its digest, signed timestamp, and transparency-log placement are shown, and it can never be edited. To correct course afterward, you sign a new file for the same obligation — you don't edit the old one.
Download, void, or review history
- Download PDF — available on an open draft or a signed file.
- Download JSON — available once a file is signed.
- Void draft — an Owner/Admin can void an open (unsigned) draft with a short reason, and start a fresh one afterward.
- The bottom of the page lists history: every previously signed file for the selected obligation.
Common questions
Can I sign with an open contradiction if I explain it in the void/narrow reason field? No — narrowing and disclosing both clear the contradiction through a real record change (a new exclusion, POA&M item, or exception), not through a free-text justification typed at sign time. There is deliberately no "acknowledge and sign anyway" path.
What happens to a contradiction if I fix the underlying record? It clears automatically the next time the draft is recomputed — you don't have to mark it resolved yourself.
Does voiding a draft affect anything I already signed? No — voiding only applies to an open (Draft/Ready) file. A signed file is frozen and untouched by anything that happens to a later draft.
Where did the old affirmation flow go? /program/cmmc-affirmations still exists and is
linked from the bottom of this page; the Signer's File is now the primary flow, with the
statement, receipts, contradictions, and history in one place.