Policy vs Operation

Show the control running, not just the policy describing it

Why CMMC policies alone are insufficient and how documents, interviews, tests, records, configurations, tickets, logs, and responsible people create operating evidence.

See the evidence chase workflow Review Examine, Interview, and Test

Policy proves definition and approval

Records prove recurring activity

Configuration and tests prove mechanisms

Interviews connect responsible people to the process

Match the evidence to the objective

Some objectives ask whether something is defined. Others ask whether it is implemented, limited, monitored, reviewed, protected, or enforced. A policy may support the first question while a configuration, record, interview, or test supports the operating question.

Build an evidence set, not a policy folder

The useful unit is the set of sources that together support the applicable objective.

Approved policy or procedure
Current configuration or mechanism
Recent records showing the activity occurred
Responsible staff who can explain the process
Test or observation showing expected behavior
Exception, change, and review history

Use missing operating proof as a truthful signal

When the policy exists but the operating record does not, the evidence ledger should say what is missing. The next action may be collecting a record, correcting the process, or routing a judgment question—not writing another policy.

What the work produces

Concrete, client-owned operating records

Policy-to-operation evidence map

Recurring-record requests

Configuration and test owner routing

Interview-owner mapping

Missing-operating-proof queue

Responsibility boundary

Facts, not verdicts

Evidence operations organize the proof of implementation. They cannot substitute paperwork for a control that does not operate.

Questions buyers ask

Frequently asked questions

Are policies still required?

Policies and procedures are relevant potential evidence for many objectives and governance needs. The point is that they often need operating evidence alongside them.

Can a screenshot prove operation?

A screenshot may support a current configuration fact, but scope, source, date, context, and other assessment methods may still be needed.

Primary references

Source context

DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods. NIST SP 800-171A (2018) Assessment procedures underlying the current CMMC Level 2 assessment-objective model. NIST has since published SP 800-171A Rev. 3, which CMMC has not yet adopted.

Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

See the evidence chase workflow →