https://cmmc20x.com/research Research papers, design proposals, policy records, and public methods for securing the Defense Industrial Base. en-us Fri, 14 Aug 2026 00:00:00 GMT https://cmmc20x.com/research/a-security-claim-should-carry-its-own-receiptshttps://cmmc20x.com/research/a-security-claim-should-carry-its-own-receiptsA security claim is reusable only when its scope, source, date, responsibility, conflicts, and reviewer stay attached.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcevidenceoscalverificationhuman-reviewhttps://cmmc20x.com/research/how-a-correction-should-move-through-the-recordhttps://cmmc20x.com/research/how-a-correction-should-move-through-the-recordA corrected source should reopen every dependent claim, finding, package, and authorized use without erasing the earlier decision trail.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmccorrectionsprovenancechange-managementhttps://cmmc20x.com/research/how-a-provider-claim-should-travelhttps://cmmc20x.com/research/how-a-provider-claim-should-travelA proposed exchange record for carrying provider evidence into a contractor's CMMC claim without erasing scope, customer duties, or reviewer judgment.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcservice-providersshared-responsibilityevidenceinteroperabilityhttps://cmmc20x.com/research/how-verification-should-scalehttps://cmmc20x.com/research/how-verification-should-scaleA proposal for varying CMMC Level 2 review depth while preserving safeguards, human authority, escalation, and Government oversight.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcgraduated-verificationriskassessmentoversighthttps://cmmc20x.com/research/the-minimum-viable-cmmc20x-pilothttps://cmmc20x.com/research/the-minimum-viable-cmmc20x-pilotA pilot should compare methods on frozen cases, publish dangerous errors, and earn each expansion of permitted use.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcevaluationpilotai-assisted-reviewhttps://cmmc20x.com/research/what-a-common-evidence-profile-must-preservehttps://cmmc20x.com/research/what-a-common-evidence-profile-must-preserveThe minimum context a CMMC security claim needs to remain traceable, challengeable, and useful across tools and reviewers.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcevidence-profileoscalinteroperabilityprovenancehttps://cmmc20x.com/research/what-actually-holds-uphttps://cmmc20x.com/research/what-actually-holds-upSeven CMMC policy options produce very different results for security, suppliers, review queues, and cost.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcreform-analysisverificationresearchhttps://cmmc20x.com/research/what-changed-after-the-july-reform-recordhttps://cmmc20x.com/research/what-changed-after-the-july-reform-recordThe July record narrowed CMMC 20X: preserve the baseline, separate evidence from verification, name legal instruments, and test assistance before reliance.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcreformchange-recordjuly-13https://cmmc20x.com/research/what-cmmc20x-cannot-automatehttps://cmmc20x.com/research/what-cmmc20x-cannot-automateA task-level boundary for software-assisted CMMC evidence work, including the judgments, authorities, and field conditions that remain human.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcautomationai-evaluationhuman-judgmentassurancehttps://cmmc20x.com/research/what-the-program-model-says-about-evidence-and-review-capacityhttps://cmmc20x.com/research/what-the-program-model-says-about-evidence-and-review-capacityThe CMMC 20X model separates evidence handling from review capacity and shows why improving either one alone leaves a different constraint in place.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcreform-analysisevidencereview-capacityverificationhttps://cmmc20x.com/research/what-would-falsify-cmmc20xhttps://cmmc20x.com/research/what-would-falsify-cmmc20xSix observable failures would require the proposal to narrow, change, or stop. A reform thesis should expose those conditions in advance.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcfalsificationevaluationresearchhttps://cmmc20x.com/research/when-evidence-can-be-reusedhttps://cmmc20x.com/research/when-evidence-can-be-reusedA decision test for reusing CMMC evidence without detaching it from scope, time, responsibility, or reviewer purpose.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcevidence-reuseproviderschange-managementverificationhttps://cmmc20x.com/research/who-remains-accountable-when-software-produces-evidencehttps://cmmc20x.com/research/who-remains-accountable-when-software-produces-evidenceA proposed authority map for keeping source records, machine analysis, human findings, and CMMC decisions distinct.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcaccountabilityhuman-reviewai-governanceevidencehttps://cmmc20x.com/research/why-cmmc20x-separates-baseline-evidence-verificationhttps://cmmc20x.com/research/why-cmmc20x-separates-baseline-evidence-verificationA design case for keeping required safeguards, proof structure, and review depth as three separate policy decisions.Thu, 13 Aug 2026 00:00:00 GMTDeep Fathomcmmcbaselineevidenceverificationpolicy-designhttps://cmmc20x.com/research/phase-2-suspension-what-changedhttps://cmmc20x.com/research/phase-2-suspension-what-changedWhat the July 13 CMMC documents changed, left in place, and left unresolved.Mon, 13 Jul 2026 00:00:00 GMTDeep Fathomcmmcpolicyphase-2current-interventionhttps://cmmc20x.com/research/introducing-cmmc-20xhttps://cmmc20x.com/research/introducing-cmmc-20xFive changes to how CMMC evidence is collected, reviewed, reused, and updated.Sat, 24 Jan 2026 00:00:00 GMTDeep Fathomcmmcannouncementautomation