Skip to content

Drift has a control number

Drift Watch · Week 2 of 12 · August 11, 2026 · by Concura's Lead CMMC assessors

Drift Watch week 2 card

"A setting changed" and "a CMMC control went soft" are the same event — described at two altitudes.

MFA enforcement loosened for one group? That's not an IT ticket, that's identification and authentication posture. An unmanaged device slipped into scope? Access control. A backup job quietly reconfigured? Media protection.

Most organizations monitor at the first altitude and get assessed at the second. The translation between them is where compliance quietly dies.

Assessor Notes is the permanent archive of the Drift Watch series — weekly notes on configuration drift and CMMC, written by Lead CMMC assessors and first published on the Concura.AI LinkedIn page. Free readiness check, written by Lead Assessors: https://concura.ai/assessment-readiness/