Evidence-backed self-review
For lower-consequence work when the organization can support its claims and Government can sample the method.
Make the security work visible, testable, and current.
Keep the safeguards. Stop rebuilding their proof for every review. Match review depth to risk, keep human judgment accountable, and recheck the claims affected when a system changes.
The outcome
CMMC should tell us whether the DIB is getting more secure.
A successful program does more than produce passing packages. It helps suppliers implement and sustain safeguards, gives reviewers a reliable basis for findings, concentrates scarce independent capacity where failure matters most, and reveals when an earlier conclusion is no longer current.
Done right, CMMC gives the Department current assurance that required safeguards are implemented and maintained, while keeping capable suppliers in the industrial base. That is how compliance supports the mission.
Near term, CMMC 20X keeps all 110 Level 2 requirements. The change is how implementation is evidenced, reviewed, reused, and refreshed—not a lower cybersecurity baseline.
The five principles
The choices that define CMMC 20X.
These positions set the direction. The operating model below defines the work.
- №01
Automation over documentation
Collect facts from systems and people once. Generate the views each authorized reviewer needs.
Read more → - №02
Continuous over point-in-time
Recheck the claims affected when systems, accounts, providers, or responsibilities change.
Read more → - №03
Assessment-ready over dashboard-green
Prepare evidence another person can trace, test, challenge, and disagree with.
Read more → - №04
Accessible over enterprise-only
Keep supplier money and attention on safeguards and qualified help—not repeated reconstruction.
Read more → - №05
Ecosystem-wide over contractor-only
Let each party prove its part without passing its responsibility downstream.
Read more →
Graduated Level 2 verification
Keep one baseline. Vary how deeply the work is checked.
Mission consequence, data sensitivity, threat exposure, supplier criticality, and material change should determine review depth. Evidence quality tells a reviewer what needs correction; it does not decide how important the mission is.
Assisted human review
For work that needs qualified review without consuming a complete C3PAO assessment. Software handles repeatable checks; a person resolves exceptions and reaches findings.
Independent C3PAO assessment
For the highest-consequence missions, sensitive data, significant unresolved risk, or conditions that require full independent examination.
The ecosystem
The proof crosses company lines. Responsibility does not disappear.
Providers should prove what their services do. Contractors should prove how those services are configured and used. Advisors prepare the work. Assessors test it independently. Primes supply mission and flowdown context. Government defines the rules, samples the system, and makes public decisions.
See the complete ecosystemTest the Blueprint
Go from the model to the work.
Each destination answers a different question. None is another definition of CMMC 20X.
Ecosystem
See what contractors, providers, advisors, assessors, primes, and Government each own.
Open →Worked evidence example
Follow one MFA claim from source export through conflict, review, and change.
Open →Government pilot
See how the working system can be vetted against Government-selected cases, reviewers, measures, and operating constraints.
Open →CMMC Reform Analysis
Compare the supplier, security, capacity, cost, and implementation effects of seven CMMC policy options.
Open →
Current application · August 2026
The RFI turns this model into decisions the Department can make now.
It proposes graduated verification, a common evidence format, clearer scope and provider rules, reusable provider evidence, and a controlled evaluation of software-assisted review.
Read the submitted RFI response