Skip to content

The 90-day gap

Drift Watch · Week 3 of 12 · August 18, 2026 · by Concura's Lead CMMC assessors

Drift Watch week 3 card

Ask a defense contractor when they last verified their assessed configuration was still true — not their patching, their configuration — and the honest answer is usually "at the assessment."

800-171 already expects better: continuous monitoring (3.12.3) is a requirement, not a bonus. A written conmon strategy plus evidence that someone actually watches is what an assessor asks for.

Free readiness check, written by Lead Assessors, if you want to see where you stand: https://concura.ai/assessment-readiness/

Assessor Notes is the permanent archive of the Drift Watch series — weekly notes on configuration drift and CMMC, written by Lead CMMC assessors and first published on the Concura.AI LinkedIn page. Free readiness check, written by Lead Assessors: https://concura.ai/assessment-readiness/