Evidence Recency

Evidence freshness depends on the process cadence and the fact being proved

A practical framework for CMMC evidence freshness without inventing a universal 90-day rule: process cadence, change triggers, source period, approval, and assessment relevance.

Build an expiration calendar Review managed maintenance
01

No blanket 90-day legal rule

02

Freshness is evidence-type-specific

03

Operational changes can invalidate recent files

04

Final form and current relevance are separate tests

Ask what the item is intended to prove

A configuration export is a snapshot of a technical state. A log-review ticket proves a recurring activity. A training record proves completion by named people. A policy proves an approved rule. Each loses usefulness for different reasons.

Use five freshness questions

A defensible cadence starts with the evidence’s relationship to the current environment and the organization’s own procedure.

  • Does the evidence cover the current assessment scope?
  • Has the system, person, provider, or process changed?
  • Does the item cover the period the process claims to operate?
  • Is it the approved final version?
  • Would the responsible operator and qualified reviewer still rely on it today?

Record the reason for the next review

A review date without rationale becomes arbitrary. The ledger should record the cadence source, next scheduled review, and events that trigger an earlier refresh.

What the work produces

Concrete, client-owned operating records

Evidence-type cadence framework
Freshness rationale field
Next-review and change-trigger fields
Stale-evidence queue
Qualified-review exceptions
Responsibility boundary

Facts, not verdicts

This framework is operational guidance, not an assessor instruction. The authorized assessment team determines whether evidence is sufficient for findings.

Questions buyers ask

Frequently asked questions

Where did the 90-day idea come from?

Recent evidence is a common assessment practice for dynamic controls, but the DoD Level 2 Assessment Guide does not set one universal 90-day expiration rule for all evidence.

Can an old policy still be valid?

Potentially, if it is approved, still accurate, and supported by evidence that the described process operates. Age alone is not the only test.

Primary references

Source context

DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods. NIST SP 800-171A (2018) Assessment procedures underlying the current CMMC Level 2 assessment-objective model. NIST has since published SP 800-171A Rev. 3, which CMMC has not yet adopted.
Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

Build an expiration calendar →