Staying Compliant Between Assessments: Evidence Maintenance That Holds Up
A CMMC certificate is a snapshot; the requirements behind it run on a calendar. What the rule asks you to keep, the recurring work that produces evidence, and the three things that can end a status before its date.
Passing a CMMC assessment proves your controls worked during the assessment. The affirmation your senior official signs afterward says something bigger: that your organization “has implemented and will maintain implementation of all applicable CMMC security requirements” (32 CFR § 170.22). The certificate is a snapshot. The requirements behind it run on a calendar.
So staying compliant between assessments isn’t mainly about keeping controls switched on. It’s about the evidence that they kept working, produced on schedule, and kept where you can find it.
What the rule makes you keep
Start with the evidence from the assessment itself. At every level, the artifacts used as evidence must be retained for six years from the CMMC Status Date (§ 170.15(c)(2), § 170.16(c)(4)). After a C3PAO assessment, those are “hashed artifacts,” hashed with a NIST-approved algorithm, and the obligation sits with you, not the C3PAO (§ 170.17(c)(4)). The preamble notes the six-year period came from the Department of Justice’s input, which tells you what it’s for.
If your assessment ended Conditional, remember that the clock doesn’t restart at closeout. “A new date is not set for a Final that follows a Conditional” (§ 170.4), so the three years and the retention period both run from the original date.
The work that produces evidence
The second kind of evidence is the kind you create as you go. A surprising amount of Level 2 is written as recurring work: requirements that say “periodically,” “on an ongoing basis,” or “maintain.” The rule defines periodically as “occurring at a regular interval as determined by the OSA that may not exceed one year” (§ 170.4(b)). You choose the interval, you write it down, and then each one is a dated record an assessor can ask for.
CA.L2-3.12.1Assess the security controls“periodically”RA.L2-3.11.1Assess risk“periodically”CA.L2-3.12.4Update the SSP“periodically”RA.L2-3.11.2Scan for vulnerabilities“periodically, and when new ones are identified”SI.L2-3.14.5Scan for malicious code“periodic scans”AU.L2-3.3.3Review which events you log“review and update”CM.L2-3.4.1Review baselines and inventories“maintained (reviewed and updated)”AffirmationAffirming Official signs again“annually”
A few of these are easy to misread. AU.L2-3.3.3, “review and update logged events,” is about reviewing which kinds of events you log, not reading the logs themselves. Monitoring security controls “on an ongoing basis” (CA.L2-3.12.3) has no single date at all; it’s the thread connecting the others. And not everything you might expect is on the calendar: Level 2 asks for initial and refresher security awareness training, but it doesn’t set an annual interval for it the way Level 3 does.
At Level 1, the calendar is simpler and stricter. You repeat the self-assessment every year and affirm again (§ 170.15(a)(1)), so the whole set of evidence is refreshed annually.
When a status ends early
A Level 2 certificate is valid for three years, but three things can cut that short.
Three ways a status ends early
- 1A significant change to your boundaryThe rule’s preamble says a new assessment is required for “significant architectural or boundary changes,” with network expansions and mergers as examples. Routine changes inside the boundary that follow your SSP don’t need one.
- 2A government assessmentDoD “reserves the right to conduct a DCMA DIBCAC assessment,” and if adherence “has not been achieved or maintained, these DCMA DIBCAC results will take precedence over any pre-existing CMMC Status.”
- 3A missed affirmationThe contract clause treats a status as current only with an affirmation no more than a year old. Skip it and the three-year certificate stops counting.
The first is the one that needs judgment. The rule doesn’t define “significant,” so a new office, a new cloud service, an acquisition or a new enclave deserves a scoping review before you decide it doesn’t count. The same review belongs in front of every affirmation, because a change you missed is a change your Affirming Official signs over.
Keeping it from becoming a scramble
The organizations that hold up well don’t rebuild evidence before each affirmation. They run the calendar.
- Write every frequency down once, in the document your SSP points to, and make each one testable.
- Give every recurring task an owner, including the ones your MSP performs. The responsibility matrix is where that lives.
- File the record when the work happens. A dated scan report, a signed risk assessment, an SSP with a revision history. Evidence assembled months later reads like it was.
- Keep it final. The rule is blunt that “working papers, drafts, and unofficial or unapproved policies” aren’t evidence (§ 170.24(b)(1)).
- Review the boundary before every affirmation, so a change gets caught by you rather than by an assessor.
One detail worth knowing: the preamble notes that no supporting evidence is uploaded with the annual affirmation itself. That’s exactly why the calendar matters. Nobody checks the evidence when you sign, so it has to already be there if anyone asks afterward.
That year-round rhythm is what our Continuous Compliance program runs for you: the recurring reviews, the evidence filed as it’s produced, and a boundary check before every affirmation date.
Sources: 32 CFR Part 170, §§ 170.4, 170.15, 170.16, 170.17, 170.22 and 170.24; CMMC Program final rule, 89 FR 83092 (October 15, 2024), preamble at 83132, 83135 and 83146; DFARS 252.204-7021, definition of “current”; NIST SP 800-171 Revision 2 and SP 800-171A (June 2018).