Evidence freshness depends on the process cadence and the fact being proved
Gridex offered this until 2026-07-25. The description it carried at the time was: “A practical framework for CMMC evidence freshness without inventing a universal 90-day rule: process cadence, change triggers, source period, approval, and assessment relevance.”
No blanket 90-day legal rule
Freshness is evidence-type-specific
Operational changes can invalidate recent files
Final form and current relevance are separate tests
Ask what the item is intended to prove
A configuration export is a snapshot of a technical state. A log-review ticket proves a recurring activity. A training record proves completion by named people. A policy proves an approved rule. Each loses usefulness for different reasons.
Use five freshness questions
A defensible cadence starts with the evidence’s relationship to the current environment and the organization’s own procedure.
- Does the evidence cover the current assessment scope?
- Has the system, person, provider, or process changed?
- Does the item cover the period the process claims to operate?
- Is it the approved final version?
- Would the responsible operator and qualified reviewer still rely on it today?
Record the reason for the next review
A review date without rationale becomes arbitrary. The ledger should record the cadence source, next scheduled review, and events that trigger an earlier refresh.
Concrete, client-owned operating records
Facts, not verdicts
This framework is operational guidance, not an assessor instruction. The authorized assessment team determines whether evidence is sufficient for findings.
Frequently asked questions
Where did the 90-day idea come from?
Recent evidence is a common assessment practice for dynamic controls, but the DoD Level 2 Assessment Guide does not set one universal 90-day expiration rule for all evidence.
Can an old policy still be valid?
Potentially, if it is approved, still accurate, and supported by evidence that the described process operates. Age alone is not the only test.
Source context
This is reference material, not an offer.
Gridex is a managed operations firm. Managed Voice Operations is the primary growth line and Managed Workflow Operations is the secondary line. There is no dashboard for anyone on the client side to run. The Voice Demo is in pilot as of 2026-08-11. Managed Voice is not yet operating for customers; demo calls are product tests, not customer production. No customer result or tested third-party integration is published. Managed Workflow Operations is the secondary line running today, and it is in validation.