Attestations
The Attestations archive is your permanent record of what you affirmed, and when. Each attestation is a point-in-time snapshot of your compliance posture — your score, your findings, your systems, and your open remediation items — frozen at the moment of generation and preserved unchanged, even as the underlying data keeps moving.
CMMC and DFARS 252.204-7012 expect a senior official to affirm that your organization meets its security requirements. This is where that affirmation is captured and kept: a named official, a confirmed affirmation, and an immutable package an auditor can open, download, and independently verify — today or years from now.
/dashboard/attestations). Every role that can view evidence can browse the archive and download records; generating a new attestation is limited to organization administrators — see Permissions.Key concepts
What an attestation is
In CMMC, an attestation (or affirmation) is a senior official's formal statement that the organization's security posture is accurate as represented. DIBFI turns that statement into a verifiable artifact: a sealed record that pins your posture to a specific date and can never be silently edited afterward.
Two kinds of record
The archive holds two kinds of attestation, and they arrive by different paths.
| Kind | How it's created |
|---|---|
| Self-assessment attestation | You generate it on demand from a chosen assessment. It freezes your full posture and captures the affirming official. |
| Operational attestation record | Generated automatically when a recurring compliance operations task is completed, and filed into your evidence as a signed record of that review. |
Record state
An assessment has one current attestation at a time. Generating a new one supersedes the previous record — the old one is never deleted, it's retained in full and marked as history.
| State | Meaning |
|---|---|
| Current | The latest attestation for the assessment |
| Superseded | Replaced by a newer attestation — kept for the audit trail |
Integrity fingerprints
Every attestation carries three cryptographic fingerprints that make it tamper-evident. If anything in a record changes, the fingerprints no longer match.
| Fingerprint | What it covers |
|---|---|
| Snapshot hash | The frozen posture (score, findings, systems, POA&Ms) |
| Package hash | The exact bytes of the downloadable package |
| Chain hash | This record plus the one before it, linking the whole sequence |
Overall finding (operational records)
Automatically generated operational attestations carry a plain-language verdict for the review period.
| Finding | Meaning |
|---|---|
| None | No issues found during the review |
| Minor | Minor issues noted |
| Major | Significant issues requiring attention |
Using Attestations
The Attestations page lists your archive newest-first, with each record's number, score, and integrity fingerprints. Once you have two or more, a score progression chart shows how your posture has moved over time.
Generate a self-assessment attestation
Generating an attestation freezes your posture and captures the affirming official in a single, sealed record.
Choose an assessment
Start a new attestation and pick the assessment you want to attest. DIBFI runs a readiness check and shows exactly what will be frozen — your score, your objective counts, and your open POA&Ms.
Clear any blockers
Some conditions block generation because they would freeze a misleading record — for example, an assessment where nothing has been assessed yet, or one with no active system in scope. Unassessed objectives that remain are allowed, but you'll see a warning (they count against your score).
Name the affirming official
Enter the name and title of the senior official making the affirmation. This is recorded on the sealed record.
Confirm the affirmation
Confirm the DFARS 252.204-7012 affirmation to proceed. Generation won't continue without it.
Generate
DIBFI freezes the posture, assembles the package, and files the record. It becomes your current attestation and supersedes the previous one.
Download a record
Open any record to see its full frozen posture and integrity fingerprints, then download its package — a complete, self-contained set of documents (score summary, methodology, assessment record, score worksheet, POA&M list, evidence summary, asset scope, and a DFARS 7012 checklist). The package is immutable and remains downloadable for the life of the record.
Review an operational attestation
When a recurring compliance operations task is completed, DIBFI automatically generates a formal attestation record for that review — with the task, period, systems reviewed, findings, the reviewer's signature, and an overall finding — and files it into your evidence. You don't generate these by hand; you review them where your evidence lives.
Permissions
Access is governed by two permissions in the role matrix.
| Capability | Permission |
|---|---|
| Browse the archive, open a record, download a package | VIEW_EVIDENCE |
| Generate a new self-assessment attestation and record the affirmation | MANAGE_ORG |
VIEW_EVIDENCE is held by every role, including Assessor — an external assessor can open and download any attestation but cannot create one. MANAGE_ORG is held by Org Admin and MSP Super (and Platform Admin) — so generating an attestation, like affirming on behalf of the organization, is reserved for administrators.
How it works
Extra detail on what an attestation stores and how it behaves — product behavior, not internals.
What a snapshot freezes
Each self-assessment attestation captures a complete, self-contained picture of your posture at generation time.
Why records never change
An attestation is written once and read back verbatim — the record you open is the frozen snapshot, not a fresh query against live data. That's deliberate: an affirmation has to stay truthful about the day it was made, even after your systems, findings, and POA&Ms have all moved on. Editing a live record after the fact would defeat the entire point of an attestation, so DIBFI doesn't allow it.
The tamper-evident chain
Records are linked in a hash chain, in order. Each record's chain fingerprint is derived from its own frozen posture and the fingerprint of the record before it. Anyone with the package can re-compute the fingerprints and confirm nothing was altered — and because the chain is sequential, tampering with an older record would visibly break every record that followed. The very first record is seeded from a fixed genesis marker.
CMMC artifact hashing (enterprise)
On enterprise plans, an attestation package can also include a CMMC artifact hash — a single fingerprint over your assessment artifacts, suitable for entry in the government's eMASS system. The package includes the material a reviewer needs to reproduce that hash independently.
Related features
Asset Inventory
Build a categorized inventory of every asset in your CMMC environment, classify each one by CUI scope to define your assessment boundary, and track what still needs review.
Document Library
Generate, edit, review, approve, and publish the policies CMMC requires — with merge fields, CMMC clause highlighting, full revision history, and PDF/Word export. Publishing turns a policy into control-linked evidence.