A boundary change can invalidate the story your evidence tells
Gridex offered this until 2026-07-25. The description it carried at the time was: “What to review when the CMMC CUI boundary changes: assets, data flows, providers, diagrams, SSP, responsibility matrices, evidence mappings, and assessment status.”
Map the old and new CUI flows
Reclassify affected assets and providers
Update SSP, diagrams, inventories, and responsibility records
Revalidate evidence support under the new boundary
Start with the changed flow of information
A boundary is not just a network line. It depends on the systems, people, facilities, and external services that process, store, transmit, or protect CUI. Document the changed flow and affected asset categories before deciding which evidence remains representative.
Reconcile scope documents and evidence
The boundary story should be consistent across the SSP, diagrams, inventories, service descriptions, responsibility matrices, and evidence ledger.
- New or removed CUI assets and security protection assets
- Changed connections, remote access, facilities, and users
- New ESPs or changes to inherited/shared responsibility
- Evidence collected from the old architecture
- New evidence and test demonstrations required
- Assessment-status and contractual coordination
Treat significant-change decisions as governed records
Record who reviewed the change, what facts were considered, what documents and evidence were updated, and whether the C3PAO, contracting party, or other authorized stakeholder was contacted.
Concrete, client-owned operating records
Facts, not verdicts
Gridex operates the documentation and evidence workflow. Gridex does not independently determine the official assessment scope or whether a new assessment is required.
Frequently asked questions
Can evidence from the old boundary still be used?
It may remain historical support, but current findings require evidence relevant to the present assessment scope and implementation. Qualified review is required.
What counts as a significant change?
The DoD scoping guide discusses significant architecture or boundary changes, but the facts and required coordination must be evaluated for the specific organization and assessment.
Source context
This is reference material, not an offer.
Gridex is a managed operations firm. Managed Voice Operations is the primary growth line and Managed Workflow Operations is the secondary line. There is no dashboard for anyone on the client side to run. The Voice Demo is in pilot as of 2026-08-11. Managed Voice is not yet operating for customers; demo calls are product tests, not customer production. No customer result or tested third-party integration is published. Managed Workflow Operations is the secondary line running today, and it is in validation.