Assessor Notes

Weekly notes from Concura's Lead CMMC assessors on what actually happens to compliance between assessments: configuration drift, continuous monitoring, desired-state baselines, and the records an assessor can read.

Each note is first published on the Concura.AI LinkedIn page and archived here permanently. New notes appear weekly during an active series.

The Drift Watch series

• Drift Watch Week 7 — Monitoring writes your evidence · September 15, 2026

  Monitoring done right emits artifacts: what was watched, what changed, what was decided, who decided. At assessment time, monitoring is exhibit A.

• Drift Watch Week 6 — Read-only is a feature · September 8, 2026

  Least-privilege, read-only discovery and attributable remediation: two questions to ask anyone who will monitor your environment.

• Drift Watch Week 5 — Anatomy of a drift disposition · September 1, 2026

  The five steps of a mature drift disposition: detect, map to the control, assess impact, decide through change control, keep the record.

• Drift Watch Week 4 — Who noticed? · August 25, 2026

  Configuration drift doesn't announce itself. Someone must be assigned to notice — and noticing must produce a record an assessor can read.

• Drift Watch Week 3 — The 90-day gap · August 18, 2026

  800-171 continuous monitoring (3.12.3) is a requirement, not a bonus. When did you last verify your assessed configuration is still true?

• Drift Watch Week 2 — Drift has a control number · August 11, 2026

  A changed setting and a softened CMMC control are the same event at two altitudes. How configuration drift maps to control posture.

• Drift Watch Week 1 — Photograph vs movie · August 4, 2026

  Your CMMC assessment is a photograph; your tenant is a movie. Why configuration drift starts the day after assessment — from Lead CMMC assessors.

---

Want to see where you stand today? The free assessment readiness check was written by the same Lead Assessors — no cost, no obligation.