Between Assessments

Turn point-in-time readiness into a repeatable evidence rhythm

How to keep CMMC evidence current with an objective ledger, evidence-specific cadences, change triggers, owner follow-up, provider evidence, and monthly review.

See the maintenance service Use the expiration calendar

One complete evidence map

Cadence based on the evidence and process

Event-driven review after operational changes

Documented requests, returns, and escalations

Current means representative of the environment

A recent file can be wrong after a system migration, and an older approved policy can remain accurate when nothing relevant changed. Evidence should be reviewed against the current people, systems, providers, processes, and assessment scope—not only its file date.

Build two clocks: cadence and change

Scheduled cadence catches recurring work. Change triggers catch evidence invalidated between scheduled reviews. Both clocks should feed the same ledger and owner queue.

Weekly or monthly records for processes claimed to run that often
Quarterly or annual reviews where the organization’s procedure establishes that cadence
Immediate review after personnel, provider, system, boundary, or policy changes
Assessment, POA&M, contract, and affirmation deadlines as hard milestones

Do not confuse alerts with completion

A GRC alert or calendar reminder identifies work. Evidence becomes current only after the responsible party produces the right item, incomplete returns are corrected, a qualified reviewer resolves questions, and the final source is recorded.

What the work produces

Concrete, client-owned operating records

Evidence cadence policy

Refresh calendar

Change-trigger workflow

Owner and provider queue

Monthly status and decision record

Responsibility boundary

Facts, not verdicts

Evidence maintenance supports the organization’s program but cannot make an unimplemented requirement true or replace qualified assessment judgment.

Questions buyers ask

Frequently asked questions

How often should evidence be refreshed?

Use the cadence of the process, the volatility of the fact, relevant changes, and assessment needs. DoD does not impose one universal refresh window for every evidence type.

Is annual review enough?

Annual review may be appropriate for some stable evidence. Recurring activities and operational changes require more frequent or event-driven proof.

Primary references

Source context

DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods. 32 CFR § 170.22 — Affirmation Requires an authorized official to affirm continuing compliance after assessment and annually thereafter. DoD CMMC Level 2 Scoping Guide v2.13 Defines the assessment scope, asset categories, ESP relationships, and responsibility documentation.

Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

See the maintenance service →