Industry playbook
Defense & CMMC compliance
Explore an illustrative control-evidence workflow. Requirements, expertise and acceptance need scoped review.
For: Defense contractors, compliance officers and the consultancies that support them.
- SharePoint
- GRC tools
- Microsoft 365 GCC
- Ticketing
- Spreadsheets
Documented vs real
This illustrative documented process has 4 steps. The illustrative alternative has 6.
A starting hypothesis from this kind of work. Every audit re-maps it with your team.
What the document says
- 1.Assess controls
- 2.Fix gaps
- 3.Collect evidence
- 4.Pass assessment
Illustrative exception path
- 1.Control list copied into a spreadsheet
- 2.Owners assigned by email, not tracked
- 3.Evidence screenshots saved in personal folders
- 4.Policy text drifts from what systems actually do
- 5.Gaps re-discovered every quarter
- 6.Week before assessment: everyone hunts for files
Where agents fit
- 1.Control-to-evidence mapping kept current
- 2.Evidence requests sent and tracked by owner
- 3.Policy-versus-configuration drift checks
- 4.Draft narratives for assessor review
What stays human
- 1.Attestation
- 2.Risk acceptance
- 3.Anything the assessor signs
Next step
Map your version of this process.
The opportunity audit replaces this hypothesis with your real process, your numbers and a ranked roadmap.