CMMC20X
Your part in the security system

Define the rules, tests, review depth, and decision authority.

Government should define what information every tool must produce, which review method applies, how results are sampled, and who can make each decision.

The position

Publish the evidence and review rules.

Technology can support review. Authorized officials remain accountable for the decisions that law, regulation, contract, and policy assign to Government.

Security responsibility

What you own. What others need from you.

The six roles perform different work and hold different authority. These are the facts this role has to supply, receive, and keep current.

Owns
Government defines the program terms, allowed methods, review criteria, legal authority, test conditions, and Government decisions.
Produces
The minimum fields every evidence record needs, test cases for tools, risk and escalation rules, correction paths, and named decision authorities.
Receives
Contractor claims, assessor findings, provider and prime context, evaluation results, and current mission and threat information.
Rechecks when
Revise the rules when authority, mission consequence, data sensitivity, threats, program performance, or measured burden and error rates change.
See how all six roles work together
In practice

Three ways to apply it.

  1. 01

    Publish one set of evidence fields and tests that multiple tools, providers, contractors, and assessors can use.

  2. 02

    Test new methods without affecting any contractor before using them for certification, awards, affirmations, enforcement, or acceptance.

  3. 03

    Set review depth from mission and data risk. Use weak evidence to trigger correction, sampling, or escalation—not to redefine the supplier’s risk tier.

Put it to work

Sponsor a Government-controlled pilot.

Bring a mission question, test environment, or difficult evidence case. Deep Fathom can bring the working system, synthetic benchmark, instrumentation, and pilot proposal.

Discuss a Government pilot