Illustrative Artifact · Synthetic Data

An illustrative ledger for objectives, owners, sources, and current status

A synthetic CMMC evidence ledger example showing how applicable objectives can be mapped to evidence, owners, source systems, dates, and factual status.

Request a synthetic ledger file See the chase log

One row per applicable assessment objective

Many-to-many links between objectives and evidence artifacts

Factual status rather than compliance verdicts

Client-owned CSV or spreadsheet that points into approved repositories

The row is an assessment objective, not a document

CMMC findings are reached at the assessment-objective level. A single policy, configuration, interview, ticket series, or test result may support more than one objective, and one objective may need multiple forms of evidence. The ledger keeps those relationships visible without pretending that every row requires a unique file.

A status should describe facts

A useful operational ledger separates evidence state from assessment judgment. “On file” means a named item exists at a known source and date. “Stale” means a refresh or review is due under the agreed cadence. “Missing” means the requested support is not available. “Awaiting decision” routes a sufficiency or scope question to the responsible human.

Objective identifier and requirement family
Evidence name, type, source location, and version
Internal owner, provider owner, and reviewer
Collected date, next review, and change trigger
Status, blocker, request history, and decision reference

The ledger is only valuable when someone operates it

The file does not send a precise request, return an incomplete screenshot, follow up with an MSP, or escalate a blocked policy approval. Gridex uses the ledger as the control surface for that recurring work and returns the updated file to the client.

Objective	Evidence	Owner	Source	Status	Next action
3.1.1[a]	Authorized-user export	IT lead	Client SharePoint	On file	Review after identity-system change
3.2.1[b]	Annual training completion	HR lead	Client LMS	Stale	Request current completion export
3.10.3[a]	Visitor activity log	Facilities	Client facility drive	Missing	Send five-minute evidence request
3.12.4[e]	CUI data-flow diagram	Security owner	Client SSP folder	Awaiting decision	Advisor confirms scope depiction

Synthetic example — abbreviated rows for illustration only.

What the work produces

Concrete, client-owned operating records

Objective register

Evidence-to-objective mapping

Owner and provider fields

Status and refresh fields

Source links and version history

Blocker and decision references

Responsibility boundary

Facts, not verdicts

This is an illustrative schema using synthetic examples. It is not an assessment result, authoritative CMMC checklist, or representation that any fictional objective is MET.

Questions buyers ask

Frequently asked questions

Does CMMC legally require this spreadsheet?

No. The ledger is an operating artifact designed to organize evidence and follow-up. DoD guidance defines findings and evidence expectations, not a mandatory Gridex spreadsheet format.

Can we use our GRC instead?

Yes. The same fields can live in an existing GRC. Gridex’s role is operating the evidence process, not forcing the spreadsheet format.

Primary references

Source context

DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods. NIST SP 800-171A (2018) Assessment procedures underlying the current CMMC Level 2 assessment-objective model. NIST has since published SP 800-171A Rev. 3, which CMMC has not yet adopted.

Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

Request a synthetic ledger file →