Part 1 of 2 | Understanding assessment scope, routine changes, and the responsibility to validate continued compliance.

Figure 1. Featured image: Understanding changes and continued compliance

As organizations achieve Cybersecurity Maturity Model Certification (CMMC) Level 2 status, maintaining that status becomes an important part of their ongoing cybersecurity program.

An organization may successfully complete an assessment only to introduce new technologies, replace equipment, expand its operations, or change its network architecture shortly afterward.

These changes raise an important question: When does modifying an organization’s environment require another CMMC assessment?

One concept frequently discussed is the possibility of using “Delta” assessments, sometimes called differential assessments, to evaluate only what has changed since the previous assessment.

Although the concept may have practical applications for internal security reviews, “Delta” assessments are not currently an authorized method for obtaining or renewing CMMC Level 2 certification.

The discussion becomes particularly interesting when examining the preamble to the October 15, 2024, CMMC final rule published in the Federal Register.

The DoD specifically addressed how changes to an organization’s environment affect the validity of its previous assessment.

Understanding that discussion is important for organizations performing CMMC self-assessments as well as those undergoing third-party certification assessments.

What the Federal Register Says About Environmental Changes

The discussion appears under the heading “Reassessment” on pages 83135–83136 of the October 15, 2024, Federal Register.

In responding to public comments, the DoD explained that both self-assessments and certification assessments apply to a defined CMMC Assessment Scope established under 32 CFR § 170.19.

The Department also distinguished between significant architectural or boundary changes and normal operational changes occurring within an existing assessment scope.

Significant changes, including network expansions and mergers or acquisitions that affect the previously assessed environment, require a new assessment.

By contrast, normal operational changes that remain within the existing assessment boundary and follow the established System Security Plan (SSP) do not require another assessment solely because those changes occurred.

Instead, the organization addresses those changes through continued compliance with the security requirements and annual affirmations.

This distinction is central to understanding the assessment lifecycle, but determining what constitutes a significant change is not always straightforward.

At the time of this writing, the interpretation of significant architectural and boundary changes remains a topic of considerable discussion within the CMMC community. Organizations operate different technical architectures, implement security requirements using different technologies, and may undergo changes that do not clearly fit into a single category.

The DoD addressed this challenge further in its May 2026 CMMC Frequently Asked Questions, particularly Question C-Q12. The guidance acknowledges that information system architectures vary and that a single prescriptive definition of a significant change is not practical.

Importantly, the DoD clarifies that the responsibility for determining whether a change is significant enough to require reassessment rests with the organization’s Affirming Official, who also bears the associated legal and contractual responsibility for continued compliance.

This determination should be supported by an appropriate evaluation of how the change affects the previously assessed environment, security requirements, and CMMC Assessment Scope.

When the significance of a change cannot be readily determined, organizations should consider consulting qualified CMMC subject matter experts who can assist with evaluating the technical and regulatory implications. The DoD’s guidance expressly recognizes the potential value of consulting authorized independent consultants.

Such consultation can help inform the decision, but it does not transfer accountability away from the organization’s Affirming Official.

Ultimately, the absence of a requirement for an immediate new assessment does not eliminate the organization’s responsibility to maintain and validate continued compliance.

The original assessment establishes a baseline. The organization must continue ensuring that the applicable security requirements remain satisfied as its environment changes.

Does This Apply to Self-Assessments and Certification Assessments?

Yes. The reassessment discussion in the Federal Register expressly addresses both self-assessments and certification assessments.

To understand why this distinction matters, it is helpful to examine two terms introduced in 32 CFR Part 170.

Under § 170.4, an Organization Seeking Assessment (OSA) is an organization seeking a CMMC self-assessment or certification assessment for a given information system.

An Organization Seeking Certification (OSC) is an organization specifically seeking certification through a CMMC Level 2 assessment conducted by a CMMC Third-Party Assessment Organization (C3PAO), or a Level 3 assessment conducted by DCMA DIBCAC.

The regulatory definition of OSA includes OSCs. An OSC is therefore also an OSA.

In ordinary discussion, however, the terms help distinguish organizations performing self-assessments from those pursuing formal certification assessments.

The same information system may be evaluated through a CMMC Level 2 self-assessment and subsequently undergo a C3PAO certification assessment.

The terminology reflects the assessment being pursued.

How the Phase II Suspension Affects This Distinction

The distinction is particularly relevant under the current CMMC implementation environment.

On July 13, 2026, the Department announced the suspension of Phase II implementation requirements, which had originally been scheduled to take effect on November 10, 2026.

Phase I self-assessment requirements remain in place while the suspension continues.

Consider an organization that expected to need CMMC Level 2 certification through a C3PAO when Phase II requirements became effective.

Under the suspension, that organization may currently be subject to the applicable self-assessment requirements rather than the anticipated certification requirement.

When performing its CMMC self-assessment, the organization is an OSA.

If the organization elects to proceed with C3PAO certification, even though the anticipated Phase II requirement is suspended, it is also an OSC for purposes of that certification assessment.

The underlying information system does not have to change for these terms to apply differently.

This distinction is useful when reading the CMMC rule because it clarifies whether a provision addresses self-assessments, certification assessments, or both.

More importantly for this discussion, the DoD’s explanation of significant architectural and boundary changes applies to both types of assessment.

Routine Changes Do Not Automatically Require Reassessment

Consider an organization that replaces several workstations with newer devices.

The workstations follow the existing security baseline, use established identity and access management services, and remain within the previously assessed environment.

The organization updates its asset inventory, implements the approved configuration, and verifies that the devices operate according to its established requirements.

This resembles the type of routine operational change discussed in the final rule preamble.

Other examples might include applying software patches, replacing network equipment with comparable equipment, or adding resources within an existing boundary.

However, whether a change qualifies as routine depends on more than the number of devices or the amount of work involved.

The change must be evaluated against the organization’s existing assessment scope, SSP, security requirements, and implementation procedures.

A small change could affect an important security function. Conversely, a large-scale replacement of similarly configured assets might remain consistent with the previously assessed environment.

Figure 2. CMMC distinguishes routine changes within an established assessment scope from significant architectural or boundary changes that require a new assessment.

Proper Configuration Is Only Part of Continued Compliance

One area that deserves additional attention is how organizations validate changes that remain within the existing assessment scope.

It may be tempting to consider a correctly configured replacement system sufficient to demonstrate continued compliance.

For example, an organization might replace a firewall, apply its approved configuration, and confirm that network connectivity functions as expected.

These are important implementation activities.

However, the presence of an approved configuration does not necessarily demonstrate that the security mechanisms are operating as intended or that all affected security requirements continue to be satisfied.

This distinction becomes important when examining NIST SP 800-171 Revision 2 requirements 3.12.1 and 3.12.3.

Although the requirements are related, they support different activities within an organization’s cybersecurity program.

Requirement 3.12.1: Periodically Assess Security Controls

NIST SP 800-171 Revision 2 requirement 3.12.1 establishes the obligation to periodically assess security controls to determine whether they are effective in their application.

This is an important foundation for an organization’s internal security control assessment program.

Rather than concentrating solely on individual technical configurations, the organization evaluates whether its implemented security controls continue to satisfy the applicable security requirements.

A comprehensive internal self-assessment can provide a structured approach to meeting this objective.

For organizations subject to CMMC Level 2 requirements, a useful practice is to conduct a complete internal assessment covering all 110 applicable security requirements and their associated assessment objectives.

Such an assessment can identify security requirements that are no longer satisfied, inconsistencies between documented procedures and actual implementation, and deficiencies introduced through changes to the environment.

Under the definition in 32 CFR § 170.4, periodically means occurring at an organization-determined regular interval that may not exceed one year.

An annual comprehensive internal assessment is therefore a practical approach for organizing security control evaluations. It is important, however, to distinguish this recommended approach from the specific wording of 3.12.1, which does not expressly require all 110 requirements to be assessed together during a single annual event.

Similarly, the formal CMMC Level 2 self-assessment required under 32 CFR § 170.16 follows a three-year cycle, with annual affirmations. An organization’s annual internal security assessment supports continued compliance but does not automatically constitute a new formally reported CMMC self-assessment.

Organizations may also conduct additional internal assessments following significant changes to their environments.

For example, replacing a major security technology, modifying network architecture, or introducing new information systems may justify evaluating the affected security requirements before the next scheduled annual assessment.

These evaluations can also take the form of gap assessments intended to identify differences between the current implementation and the applicable security requirements.

A targeted gap assessment can address particular changes, while a comprehensive assessment examines the broader security program.

Both activities can help the organization maintain accurate knowledge of its compliance status.

Requirement 3.12.3: Monitor Security Controls on an Ongoing Basis

Requirement 3.12.3 addresses the ongoing monitoring of security controls to ensure their continued effectiveness.

Unlike a comprehensive periodic assessment, ongoing monitoring involves activities performed throughout the year.

These activities may be continuous, automated, or conducted according to established monitoring schedules.

For example, an organization might continuously collect security logs, review vulnerability scan results monthly, examine privileged account activity at established intervals, and perform quarterly reviews of selected security configurations.

Monitoring frequency should reflect the nature of the security control, the organization’s risk exposure, and the need to identify changes that could affect control effectiveness.

Not every control must be manually examined every day.

Instead, the organization should establish a monitoring approach that provides sufficient visibility into whether its implemented security controls continue operating as intended.

Consider the earlier example involving the replacement of a firewall.

Following installation, the organization should verify that the approved configuration has been applied and that the relevant security functions operate correctly.

The new firewall would then become part of the organization’s ongoing monitoring activities.

These activities might include examining firewall events, reviewing rule changes, evaluating alerts, verifying logging functionality, and periodically confirming that approved traffic restrictions remain enforced.

The resulting evidence can help identify implementation deficiencies or changes that require further evaluation.

How 3.12.1 and 3.12.3 Work Together

These two requirements serve complementary purposes.

Requirement 3.12.1 supports periodic evaluation of security control effectiveness. A comprehensive internal assessment, typically performed annually, can provide the organization with a broader evaluation of whether its applicable requirements remain satisfied.

Requirement 3.12.3 supports continued awareness between those assessments. Scheduled and automated monitoring activities help identify changes, deviations, or deficiencies that may affect security control effectiveness.

For example, an organization may complete a comprehensive internal assessment in January while performing scheduled monitoring activities throughout the following twelve months.

If those activities identify a significant deficiency or the organization changes its environment, additional assessment activities may be necessary rather than waiting for the next scheduled review.

Together, these practices provide a structured approach to maintaining confidence in the continued effectiveness of the organization’s security controls.

However, neither requirement establishes an alternative process for obtaining or renewing CMMC certification through a partial “Delta” assessment.

Figure 3. Requirement 3.12.1 supports periodic evaluation; requirement 3.12.3 supports scheduled and continuous monitoring throughout the year.

Other Requirements Support Change Evaluation

Several additional NIST SP 800-171 Revision 2 requirements contribute to the process.

Requirement 3.4.3 addresses tracking, reviewing, approving or disapproving, and logging changes to organizational systems.

Requirement 3.4.4 requires analysis of the security impact of changes before implementation.

Requirement 3.11.1 addresses periodic risk assessments, while 3.12.4 requires maintaining an SSP that accurately describes the system boundary, operating environment, and implementation of security requirements.

Together, these requirements establish important responsibilities for managing and evaluating changes throughout the assessment lifecycle.

They also provide a practical foundation for internal reviews that examine how modifications may affect continued compliance.

What About Operational Plans of Action?

The final rule preamble also recognizes that organizations may use operational plans of action to address necessary updates, patches, and reconfigurations.

Under 32 CFR § 170.4, an operational plan of action addresses temporary vulnerabilities or deficiencies associated with normal system operations.

This is distinct from a CMMC assessment POA&M used to address qualifying NOT MET findings under the formal assessment process.

The existence of an operational plan of action does not eliminate the responsibility to maintain compliance or change the requirements for determining whether another CMMC assessment is necessary.

Rather, it provides a documented mechanism for managing temporary operational issues as they arise.

When Does a Change Require Another Assessment?

The Federal Register preamble identifies significant architectural or boundary changes as the determining concern.

A network expansion, merger, acquisition, or other business activity may substantially alter the information systems previously evaluated.

When a change significantly modifies the CMMC Assessment Scope, a new assessment is required.

The organization’s ongoing assessment and monitoring activities remain important, but they do not substitute for a new assessment when required by the CMMC Program.

This distinction applies whether the organization is conducting a self-assessment or pursuing certification.

It is also the distinction that must remain clear when discussing “Delta” assessments.

Targeted internal reviews can evaluate changes, identify affected requirements, and provide evidence of continued control effectiveness.

However, an internal review cannot be used as an alternative certification methodology when a new CMMC assessment is required.

Understanding the Responsibility to Maintain Compliance

The CMMC final rule establishes a clear relationship between assessment scope, operational changes, and continued compliance.

Routine changes may remain within an established assessment scope when they follow the SSP and preserve the organization’s compliance with applicable requirements.

Significant architectural or boundary changes require a new assessment.

In either circumstance, the organization remains responsible for ensuring that its security requirements continue to be satisfied.

Requirements 3.12.1 and 3.12.3 play complementary roles in supporting that responsibility. Periodic comprehensive assessments can provide a broader evaluation of security control effectiveness, while scheduled monitoring activities throughout the year help identify conditions that require additional attention.

For organizations maintaining CMMC Status, the objective is not simply to preserve an approved technical configuration. It is to maintain security controls that continue operating effectively as the environment changes.

Figure 4. Changes should be evaluated for effects on CUI flows, security requirements, scope, and control effectiveness.

Coming Next: What Happens When Major Business Changes Affect Certification?

In Part 2, we examine situations where an organization has recently completed its CMMC assessment and then undergoes a substantial change.

These include opening a new CUI-processing facility, migrating to another cloud provider, and integrating information systems following a merger or acquisition.

We will also consider why these situations contribute to discussions about “Delta” assessments and what would be necessary for such a methodology to become an authorized part of the CMMC Program.