Passing a CMMC assessment is a snapshot, but the program expects you to stay compliant. Per law firm summaries of the final rules, affirmations are due every year at every level, and status is recorded in SPRS. So build routine monitoring: track changes, fix drift, and keep evidence fresh before the next affirmation.
Important caveat: we could not open the Federal Register text or the DoD CIO CMMC page, which blocked our fetch. The facts below come from law firm summaries and a NIST page. Confirm dates and mechanics against the official sources before you plan around them, and ask your assessor.
What does the program require after the assessment?
According to the summaries we read, the 32 CFR Part 170 rule took effect on 16 December 2024, and the companion DFARS rule took effect on 10 November 2025, starting a phased rollout. They describe affirmation as required at every level. Level 2 requires a third party assessment every three years, or a self assessment for select programs, plus an annual affirmation made by an Affirming Official. Current status and affirmations are recorded in SPRS and must be current for awards, option exercises and extensions.
The summaries also say Level 2 and Level 3 contractors can operate under conditional status for up to 180 days while closing a valid plan of action and milestones. One law firm describes the phase in as four phases over three years, with Phase One starting 10 November 2025. Those details are secondary, so check them.
So the practical meaning is simple. Every year someone senior affirms that you still meet the requirements. If systems drifted since the assessment, that affirmation is hard to sign honestly.
What does continuous monitoring mean here?
NIST SP 800-171 is the security requirements publication for protecting controlled unclassified information on nonfederal systems. NIST's page says Revision 2 was withdrawn on 14 May 2024 and superseded by Revision 3. Which revision applies to you depends on your contract and the program rules, so confirm with your contracting officer.
Monitoring in this setting is the habit of checking, on a schedule, that controls still work. Think in layers.
Daily or continuous. Vulnerability alerts for software in your CUI boundary, endpoint and log alerts, new accounts and privilege changes.
Monthly or quarterly. Access reviews, patch status against your own target times, configuration drift checks, vendor and tool inventory changes.
Annually, before the affirmation. A walk through every requirement with fresh evidence, a review of open plan items, and a check that the system boundary description still matches reality.
Where the software supply chain shows up
Your boundary includes the software in it. New dependencies, build tools and agents arrive weekly. If you cannot say what changed, you cannot say the boundary is unchanged. An SBOM per release, re scanned against new advisories, gives a dated record of what was present and what you did about it.
Safeguard builds SBOMs and scans dependencies from the CLI, IDE and CI, and its documentation describes continuous scanning that rescans assets when vulnerability feeds change, not only at build time. The local runner keeps source on your machine and pushes only encrypted results. Safeguard does not certify you for CMMC, and we do not claim framework coverage here. Check the framework library before you rely on it.
What to do
- Put a named owner and a date on the annual affirmation, and work backward from it.
- Keep a living system boundary diagram and update it with every significant change.
- Rescan software in the boundary on a schedule and on new advisories.
- Track plan of action items with due dates, owners and proof of closure.
- Collect evidence monthly, not in the week before the audit.
- Re read the program rules and your contract once a year for changes.
Quick check
Is a CMMC assessment valid forever?
No. Per the summaries we read, Level 2 certification runs on a three year cycle with an affirmation every year. Check the official rule for the exact terms.
Can a scanner keep us compliant?
It helps with vulnerability and inventory evidence. It does not cover policy, training, physical or personnel controls, and it does not grant certification.
Sources
- Polsinelli: DoD publishes final rule to establish its CMMC program, found by search 18 October 2026
- Wiley: Additional analysis on DoD's final rule for the CMMC program, found by search 18 October 2026
- NIST: SP 800-171 Rev. 2 publication page, fetched 18 October 2026
- Safeguard documentation: Continuous scanning, fetched 18 October 2026
Last reviewed: 18 October 2026.
