Skip to content

Read-only is a feature

Drift Watch · Week 6 of 12 · September 8, 2026 · by Concura's Lead CMMC assessors

Drift Watch week 6 card

Two questions for anyone who will monitor your environment.

Can they see without touching? Discovery should be least-privilege and read-only.

And when something must change, is remediation an explicit, attributable, approved action — or a bot with write access?

"Never auto-remediate" isn't excess caution. It's configuration management's own logic: change control applies to the fixers, too.

Assessor Notes is the permanent archive of the Drift Watch series — weekly notes on configuration drift and CMMC, written by Lead CMMC assessors and first published on the Concura.AI LinkedIn page. Free readiness check, written by Lead Assessors: https://concura.ai/assessment-readiness/