Operating Model

A monthly operating rhythm across objectives, owners, vendors, and evidence

The step-by-step managed CMMC evidence operating model: baseline, owner mapping, requests, review, escalation, filing, monthly digest, and change-trigger refresh.

See a synthetic monthly cycle Request a bounded sprint
01

No client dashboard or new tool to learn

02

One ledger across all applicable objectives

03

Precise requests with a documented escalation path

04

Client-owned outputs and transparent activity records

1. Establish the operating scope

Gridex imports the agreed objective set, known assets and providers, evidence inventory, SSP references, POA&M items, and assessment or affirmation dates. Unknowns stay visible; they are not converted into optimistic statuses.

2. Convert gaps into assigned work

Each missing, stale, or change-affected item becomes a request with an owner, requested output, due date, location, and escalation path. Technical requests go to the technical operator. Organization requests go to the function that creates the fact.

  • Ask with exact evidence examples and scope context.
  • Return incomplete items with a precise correction request.
  • Log reminders, responses, escalations, decisions, and filing.
  • Route judgment questions to the client or qualified advisor.

3. Close the month with a decision-ready record

Leadership receives movement, current/open status, evidence approaching refresh, unresolved decisions, provider blockers, and the next cycle’s work. The detailed ledger and chase log remain available for operational and assessment use.

What the work produces

Concrete, client-owned operating records

Baseline evidence ledger
Owner and provider request queue
Chase and escalation log
Monthly evidence digest
Change-trigger and next-cycle plan
Responsibility boundary

Facts, not verdicts

Gridex operates the workflow and factual record. Gridex never replaces the organization’s responsibility to implement requirements or the assessor’s responsibility to make findings.

Questions buyers ask

Frequently asked questions

Do users need a Gridex login?

No client portal is required. The operating model can use email and the client’s existing repository, with client-owned spreadsheet and document outputs.

What does Gridex check on returned evidence?

Gridex can check identity, date, scope, source, approval status, legibility, and whether the requested material was actually returned. Security sufficiency remains a qualified judgment.

How often is evidence refreshed?

Cadence follows the process and change risk. Some items are event-driven, others monthly, quarterly, annually, or assessment-triggered.

Primary references

Source context

DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods. DoD CMMC Level 2 Scoping Guide v2.13 Defines the assessment scope, asset categories, ESP relationships, and responsibility documentation. 32 CFR § 170.22 — Affirmation Requires an authorized official to affirm continuing compliance after assessment and annually thereafter.
Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

See a synthetic monthly cycle →