Skip to content

Photograph vs movie

Drift Watch · Week 1 of 12 · August 4, 2026 · by Concura's Lead CMMC assessors

Drift Watch week 1 card

Your CMMC assessment is a photograph. Your tenant is a movie.

The day after any assessment, someone creates an account, relaxes a Conditional Access policy to troubleshoot, or installs software outside the allowlist. None of it is malicious. All of it is drift — and every drifted setting maps to a control you attested to.

The uncomfortable question isn't "did we pass?" It's "are we still the company that passed?"

Assessor Notes is the permanent archive of the Drift Watch series — weekly notes on configuration drift and CMMC, written by Lead CMMC assessors and first published on the Concura.AI LinkedIn page. Free readiness check, written by Lead Assessors: https://concura.ai/assessment-readiness/