An illustrative ledger for objectives, owners, sources, and current status
Gridex offered this until 2026-07-25. The description it carried at the time was: “A synthetic CMMC evidence ledger example showing how applicable objectives can be mapped to evidence, owners, source systems, dates, and factual status.”
One row per applicable assessment objective
Many-to-many links between objectives and evidence artifacts
Factual status rather than compliance verdicts
Client-owned CSV or spreadsheet that points into approved repositories
The row is an assessment objective, not a document
CMMC findings are reached at the assessment-objective level. A single policy, configuration, interview, ticket series, or test result may support more than one objective, and one objective may need multiple forms of evidence. The ledger keeps those relationships visible without pretending that every row requires a unique file.
A status should describe facts
A useful operational ledger separates evidence state from assessment judgment. “On file” means a named item exists at a known source and date. “Stale” means a refresh or review is due under the agreed cadence. “Missing” means the requested support is not available. “Awaiting decision” routes a sufficiency or scope question to the responsible human.
- Objective identifier and requirement family
- Evidence name, type, source location, and version
- Internal owner, provider owner, and reviewer
- Collected date, next review, and change trigger
- Status, blocker, request history, and decision reference
The ledger is only valuable when someone operates it
The file does not send a precise request, return an incomplete screenshot, follow up with an MSP, or escalate a blocked policy approval. Gridex uses the ledger as the control surface for that recurring work and returns the updated file to the client.
What the working artifact can contain
| Objective | Evidence | Owner | Source | Status | Next action |
|---|---|---|---|---|---|
| 3.1.1[a] | Authorized-user export | IT lead | Client SharePoint | On file | Review after identity-system change |
| 3.2.1[b] | Annual training completion | HR lead | Client LMS | Stale | Request current completion export |
| 3.10.3[a] | Visitor activity log | Facilities | Client facility drive | Missing | Send five-minute evidence request |
| 3.12.4[e] | CUI data-flow diagram | Security owner | Client SSP folder | Awaiting decision | Advisor confirms scope depiction |
Synthetic example — abbreviated rows for illustration only.
Concrete, client-owned operating records
Facts, not verdicts
This is an illustrative schema using synthetic examples. It is not an assessment result, authoritative CMMC checklist, or representation that any fictional objective is MET.
Frequently asked questions
Does CMMC legally require this spreadsheet?
No. The ledger is an operating artifact designed to organize evidence and follow-up. DoD guidance defines findings and evidence expectations, not a mandatory Gridex spreadsheet format.
Can we use our GRC instead?
Yes. The same fields can live in an existing GRC. Gridex’s role is operating the evidence process, not forcing the spreadsheet format.
Source context
This is reference material, not an offer.
Gridex is a managed operations firm. Managed Voice Operations is the primary growth line and Managed Workflow Operations is the secondary line. There is no dashboard for anyone on the client side to run. The Voice Demo is in pilot as of 2026-08-11. Managed Voice is not yet operating for customers; demo calls are product tests, not customer production. No customer result or tested third-party integration is published. Managed Workflow Operations is the secondary line running today, and it is in validation.