Topic starter
02/08/2026 11:35 am
TL;DR: Updated CMMC guidance shifts the DIB away from periodic compliance toward continuous validation, because point-in-time assessments can miss exploitable drift, supplier exposure, and attack paths that emerge after certification, according to Horizons.ai. The lesson for security and IAM teams is that evidence of control effectiveness now matters more than documentation alone.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “You’re Only as Secure as Your Last Evaluation”.
By the numbers:
- Phase 1 runs from Nov 10, 2025 to Nov 9, 2026 and focuses on self-assessments for Levels 1 and 2.
- Beginning Nov 10, 2026, solicitations will require Level 2 certifications.
Key questions
Q: What breaks when CMMC validation is only done at certification time?
A: Point-in-time validation can miss drift in configurations, supplier relationships, and identity paths that emerges after the assessment closes.
Q: Why do supplier access paths increase CMMC risk so quickly?
A: Supplier access amplifies risk because one compromise can move through shared credentials, federated identity, or poorly segmented trust boundaries into multiple connected environments.
Q: How do teams know continuous validation is actually working?
A: They should see fewer unknown gaps, faster confirmation of control drift, and more reliable response outcomes when access patterns change.
Practitioner guidance
- Implement continuous attack-path validation Test whether a supplier, credential, or foothold can still traverse the environment after normal operational changes, not just during audit windows.
- Reassess third-party identity trust Review shared credentials, federated identity links, and supplier access boundaries to confirm they still enforce the intended segmentation.
- Tie CMMC evidence to live control behaviour Replace static documentation-only evidence with recurring proof that controls stop lateral movement, privilege escalation, and credential abuse in current conditions.
Bottom line: CMMC continuous validation is really a control-effectiveness problem, not just a compliance problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:49 pm
Continuous validation is now a governance requirement, not a testing preference. CMMC is being used here to expose a structural flaw in how organisations equate passing an assessment with being secure afterward. That assumption breaks as soon as supplier relationships, SaaS change, or identity paths evolve. Practitioners should treat validation as an ongoing control proof cycle, not a one-time compliance event.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when compliance posture and operational risk diverge?
A: Accountability sits with the teams that own access, segmentation, and third-party governance, because those controls determine whether compliance evidence still matches reality. In a CMMC context, that means security, IAM, and supplier-risk owners have to share responsibility for keeping the control state current.
👉 Read our full editorial: CMMC continuous validation exposes the gap between compliance and risk