A drift report, end to end
Drift Watch · Week 10 of 12 · October 6, 2026 · by Concura's Lead CMMC assessors
What does a drift report actually look like? One example, end to end.
Tuesday, 2:14 PM: a Conditional Access policy is switched from "require MFA" to report-only for one group. The next drift report shows what changed, when, and by which account; the approved-baseline value it moved away from; and the potentially affected CMMC requirements — in this case, identification and authentication coverage — explained in plain language.
Your team decides what happens next, with the facts in front of them. That's Configuration Drift and Security Monitoring.
Assessor Notes is the permanent archive of the Drift Watch series — weekly notes on configuration drift and CMMC, written by Lead CMMC assessors and first published on the Concura.AI LinkedIn page. Free readiness check, written by Lead Assessors: https://concura.ai/assessment-readiness/ · The service behind the series: https://concura.ai/products/