CMMC reform news could arrive soon. The Cyber AB holds its next Town Hall on Tuesday, October 27, and the CMMC Reform Task Force's findings still aren't public.
At September's Town Hall, presenters shared what they openly called speculation: DoD may be moving away from point-in-time assessments that go stale quickly. Nobody outside DoD knows for sure. But if the program shifts toward ongoing proof that your security works, the teams that already collect evidence continuously will be ready.
Here's how to start, regardless of what's announced.
Treat evidence like logs, not like homework
Most teams gather screenshots and exports the week before an assessment. Flip that around. Set up your systems to produce evidence on a schedule:
Export MFA enrollment and conditional access reports monthly
Keep vulnerability scan results with dates attached
Save your patch compliance reports
Retain the record of each access review, including who approved it
Centralize your audit logs
NIST SP 800-171 already requires you to create and retain audit logs (3.3.1) and to review them (3.3.3). Send logs from your identity provider, endpoints, firewall, and cloud apps to one place. Alerting on what matters is what turns "we have logs" into "we watch our environment."
Map evidence to requirements
For each of the 110 requirements, write down:
What proves it's working
Where that proof lives
How often it's refreshed
Who owns it
That list belongs in your System Security Plan (SSP), and it's what makes your SPRS score defensible on any given day.
Automate the boring checks
Small scripts go a long way. A weekly job can flag accounts without MFA, devices missing encryption, or users who haven't signed in for 90 days. Each run is both a fix list and a piece of dated evidence.
Keep the basics current
None of this replaces the fundamentals. If your contract includes DFARS 7012, you still need to protect CUI under NIST SP 800-171 and keep an accurate SPRS score today, whatever reform brings.
Need a hand?
Cyberneza is a veteran-owned, 100% US-based cybersecurity firm that helps defense contractors prepare for CMMC. Start with our free SPRS Score Worksheet or get in touch.
Top comments (0)