Notifications
Clear all
Topic starter
02/08/2026 11:35 am
TL;DR: Updated CMMC guidance shifts the DIB away from periodic compliance toward continuous validation, because point-in-time assessments can miss exploitable drift, supplier exposure, and attack paths that emerge after certification, according to Horizons.ai. The lesson for security and IAM teams is that evidence of control effectiveness now matters more than documentation alone.
NHIMG editorial — based on content published by Horizons.ai: You’re Only as Secure as Your Last Evaluation
Questions worth separating out
Q: What breaks when CMMC is treated as a point-in-time assessment?
A: The main failure is control drift.
Q: Why do identity controls matter so much in CMMC programmes?
A: CMMC is not only about technical hardening.
Q: What do security teams get wrong about continuous validation?
A: They often treat it as a replacement for governance instead of an evidence layer on top of governance.
Practitioner guidance
- Validate attack paths continuously Run recurring tests that prove whether a foothold can progress from initial access to privilege escalation and credential harvesting, rather than relying on annual or quarterly assessments.
- Map third-party identities to CMMC scope Inventory every supplier, MSP, and subcontractor account that can reach FCI or CUI, then tie each identity to a business owner, access scope, and offboarding trigger.
- Test segmentation and privilege boundaries Confirm that local administrator access, remote access tools, and lateral movement routes are blocked or tightly constrained after initial compromise.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The exact continuous-validation workflow used to test CMMC-relevant control effectiveness across supplier environments
- The assume-breach example showing how a single host foothold progressed into credential access and local administrator abuse
- The practical differences between point-in-time assessments, vulnerability scanning, and attack-path validation
- The broader DIB compliance framing behind CMMC phase changes and supplier assurance
👉 Read Horizons.ai's analysis of CMMC continuous validation and supply chain risk →
CMMC continuous validation: are your controls keeping up with reality?
Explore further
02/08/2026 12:49 pm
Continuous validation is becoming a governance requirement, not a testing preference. Point-in-time assessment models were designed for slower change cycles, but supply chains now evolve too quickly for periodic evidence to carry much assurance value. The control question is no longer whether a control existed during an audit window, but whether it still works after configuration drift, vendor changes, and new access paths appear. Practitioners should treat continuous validation as part of operational governance.
A question worth separating out:
Q: Who is accountable if a supplier fails CMMC requirements?
A: The supplier remains accountable for meeting the level required by its contract, but primes and contracting chains also shape the scope by deciding what data flows down. In practice, accountability sits with the organisation that accepts the work and the control owners who must prove access, documentation, and remediation are in place.
👉 Read our full editorial: CMMC continuous validation exposes the gap between compliance and risk
