CMMC continuous monitoring is the ongoing practice of checking that your security controls still work after the assessment is over. For a Level 2 contractor, it comes from one requirement, CA.L2-3.12.3, and it matters because your certification covers a multi-year period while your environment changes every week. This guide explains what the requirement asks for, what to monitor, how often, and what evidence to keep.
What “continuous monitoring” means in CMMC
CMMC does not have a separate monitoring program you sign up for. The expectation lives in security requirement CA.L2-3.12.3, which comes from NIST SP 800-171. In plain terms, it asks you to keep watching your security controls on an ongoing basis so you know they are still working.
Notice what it does not say. It does not name a tool, a frequency or a dashboard. It asks for a repeatable process that catches a control failing, and for proof that the process runs.
Two neighboring requirements shape how you meet it:
- CA.L2-3.12.1 asks you to assess your controls periodically to see whether they are effective.
- CA.L2-3.12.2 asks you to keep a plan of action for deficiencies you find and to track them to closure.
Monitoring is the connective tissue. It is how a gap you find in March ends up on a plan, with an owner, instead of sitting in someone’s inbox until the next assessment.
Monitoring also feeds your System Security Plan. If the SSP says accounts are reviewed quarterly, monitoring is how you show that the quarterly review happened.
Why a point-in-time assessment isn’t enough
An assessment looks at your environment on specific days. Your environment keeps moving afterward. New hires get accounts, contractors get admin rights, a firewall rule gets opened for a project and never closed, a policy gets exempted “just for now.”
This is drift, and it is the main reason continuous monitoring exists. Common sources:
- Accounts that stay active after someone leaves or changes roles
- Local administrator rights added on individual workstations
- Conditional access or MFA policies edited, with exclusions added
- Endpoint settings (encryption, patching, screen lock) that fall out of line on a few machines
- Recurring reviews that were scheduled and then quietly skipped
- Documents that describe a system that no longer exists
An illustrative scenario (hypothetical): A contractor passes review with a clean conditional access setup. Four months later an administrator adds a group exclusion so a vendor can get in during an outage, and the exclusion is never removed. Nothing is broken on paper. Nothing is recorded as a change anyone reviewed. The control has changed from what was assessed, and the first person to notice is whoever opens the portal next.
A monitoring process is how that exclusion gets caught in a week instead of at the next assessment.
The annual affirmation and the months in between
Under the CMMC program rule (32 CFR Part 170), a Level 2 certification is not a one-time event. The certification period runs for multiple years, and a senior official at the company affirms continued compliance every year after the assessment.
That affirmation is a statement from your own leadership that the controls are still in place. The assessor does not re-check you each year, so the statement rests on what you actually know about your environment.
If the only evidence behind it is the assessment from last year, the official is signing on faith. If you have monitoring records showing weekly checks, reviews that ran on schedule and gaps that were found and tracked, the official is signing on a record.
That is the practical argument for continuous monitoring. It is not extra work for its own sake. It is what lets someone sign the affirmation with a clear conscience, and it keeps the next assessment from becoming a reconstruction project.
The details of the affirmation and the certification period are set out in the rule itself. Read the current text, or ask your assessor, before you build your process around specific dates.
What to monitor
You cannot watch everything at the same depth, and you do not need to. Start with the places where drift is common and where an assessor will look.
| Area | What to check | How it typically fails |
|---|---|---|
| User accounts | Inactive accounts, disabled-user cleanup, new privileged accounts | Departed staff still active; admin rights granted and never reviewed |
| Endpoints | Disk encryption, patch level, screen lock, local admins, endpoint protection status | A few machines fall out of the baseline after an image change or a late join |
| Cloud tenant | MFA and conditional access, mail flow rules, audit logging, device compliance policies | Exclusions added during an outage; logging turned off by a migration |
| Network | Firewall and switch configuration against the approved baseline | Temporary rules left in place; config changes with no ticket |
| Change control | Tickets for changes, approvals, who made what change | Changes made directly with no record to tie them to |
| Security events | SIEM or MDR cases opened, triaged and closed | Alerts that sit unreviewed; cases closed with no notes |
| Documents | Policies and procedures reviewed on their stated schedule | A review date passes with no review |
| Recurring activities | Access reviews, vulnerability scans, training, backup tests | Scheduled once, then no owner and no due date |
Two points on this list.
First, some of these can be read directly from a system, and some can only be shown through a record that a person did the work. Both count, but they are different kinds of evidence, and you should know which kind each of your objectives relies on.
Second, monitoring a control is not the same as proving the requirement is met. A setting can be correct and the objective still depend on a procedure, a training record or a decision. Your assessor decides what is sufficient.
A practical monitoring cadence
CMMC does not set a schedule, so you choose one and stick to it. What matters is that your SSP, your procedures and your records all agree. A cadence that works for a small team:
| Frequency | What happens | Who owns it |
|---|---|---|
| Daily or continuous | Security alerts triaged; endpoint protection and logging health checked automatically | SOC / MDR provider or IT lead |
| Weekly | Review of new accounts, privilege changes, failing checks and open findings; short status note | IT / security lead |
| Monthly | Patch and vulnerability review; firewall and cloud configuration compared with the baseline | IT / security lead |
| Quarterly | Access review across all in-scope accounts; review of open plan-of-action items; summary report to leadership | Security lead with a business owner |
| Annually | Policy and SSP review; full self-assessment refresh; the senior official’s affirmation | Executive sponsor |
These are examples, not requirements. Pick intervals you can keep. A quarterly review that happens four times a year is worth more than a monthly review that happens twice.
Each activity should have a named owner and a due date. Work with no owner is the first thing to slip.
What evidence an assessor wants from monitoring
Assessors work objective by objective. For each one they want to see how you know the control is working, and they test that through three methods: examining documents and records, interviewing people, and testing the system itself.
Monitoring records support all three. What makes them useful:
- Dated. A record that shows when a check ran and what it found.
- Repeated. More than one data point, so the assessor can see a pattern and not a single good day.
- Sourced. Clear about where the data came from, such as a tenant setting, a device check or a ticket.
- Tied to an objective. Someone can follow it from the requirement to the evidence without guessing.
- Followed through. When a check fails, there is a record of who was told, what was done and when it closed.
- Tamper-evident. Files kept in a way that shows whether they were altered after the fact.
The last item is the one teams forget. A folder of screenshots proves little if no one can say when each was taken or whether it was changed. A record with a timestamp and a hash proves more.
Failures belong in the record too. A monitoring log with no failures in it makes an assessor wonder whether anyone is looking. A log that shows a failure, an owner and a closeout shows a process that works.
Manual versus automated monitoring
You can monitor manually. A small team with a short checklist, a shared calendar and disciplined note-taking can meet the requirement. The cost shows up in two places: the time it takes and the gaps between checks.
Automation helps where a check is repetitive and reads a system: account status, device settings, tenant configuration, DNS records for email authentication, configuration files. A script runs the same way every time and records when it ran.
Automation does not help much, and should not be claimed to, where an objective depends on judgment or a human act: whether a policy is appropriate, whether training covered the right material, whether a scope decision is sound, whether a risk was accepted by the right person.
A fair way to sort your objectives:
- Verified by a system check. The evidence comes from reading the environment.
- Informed by a system check. A setting supports the objective but does not prove it alone.
- Documentary. The evidence is a policy, procedure or record of an activity.
- Not yet verified. You have no evidence yet, and you should say so.
Be wary of any tool or process that shows everything as green. Honest monitoring has a fourth category, and it is not empty on day one.
How Continu-US supports continuous monitoring
Continu-US, built by ATLLC, is a platform for verifying controls continuously and keeping the evidence, instead of relying on screenshots and spreadsheets once a year.
Here is what it does for the monitoring process described above.
- Runs in your own Azure environment. It is deployed as a managed application in your Azure subscription, Commercial or Government, so your data stays in your tenant. It reads your environment with read-only access and stores no passwords or secrets for cloud connections.
- Collects evidence from many sources. Windows, Windows 365 and Linux endpoint check scripts (hash-pinned, enrolled per device); 70 checks across Microsoft 365, Entra, Intune, Defender, Exchange, Purview and Azure; AWS, Google Cloud and Google Workspace; email DNS (SPF, DKIM, DMARC); FortiGate and Cisco network configurations; and ticket, change and SIEM data from popular solutions like Jira, ServiceNow, Elastic, Sentinel and Huntress.
- Maps evidence to each objective. For every objective it shows what evidence covers it, what is failing, and what could count once collected.
- Shows an honest verification matrix. Each objective is marked automatically verified, technically informed, documentary or not yet verified.
- Tracks the human side. A documents register holds your policies, procedures and evidence artifacts, and recurring activities carry owners and due dates so reviews do not lapse.
- Watches account activity. Inactive accounts, local administrators and LAPS coverage are monitored.
- Reports on a schedule. Weekly and week-to-date status reports, plus quarterly assessment reports.
- Keeps findings moving. POA&M eligibility under 32 CFR 170.21 and closeout tracking, with an audit log of every decision.
- Packages evidence for the assessor. Evidence packages arrive as a zip with per-objective folders, HTML views and file hashes.
- Calculates your score. The SPRS score uses the DoD Assessment Methodology, alongside the CMMC score, and it fills in the DoD self-assessment workbook.
The same evidence is also shown against PCI DSS 4.0.1 and NIST SP 800-53 Rev 5 Moderate through reviewed crosswalks, which helps if you handle more than one framework.
What it does not do. Continu-US verifies and evidences controls. It does not make an organization compliant or certified, and it does not decide whether an objective is met. The assessor decides. ATLLC is a C3PAO, and buying Continu-US has no bearing on any certification outcome.
A checklist you can start this week
- Write down your monitoring cadence (daily, weekly, monthly, quarterly, annual) and make sure your SSP and procedures say the same thing
- Assign an owner and a due date to every recurring review
- List your objectives and mark each as system-verified, system-informed, documentary or not yet verified
- Pull a current list of accounts, local administrators and inactive users, and keep it dated
- Check that your cloud audit logging and endpoint protection are reporting
- Compare firewall and cloud configuration with your approved baseline and record any differences
- Open a plan-of-action entry for every gap you find, with an owner and a target date
- Start a simple weekly status note: what was checked, what failed, what is open
- Decide where evidence is stored, how it is dated and how you would show it has not been altered
- Brief the executive who signs the annual affirmation on what the monitoring record shows
Frequently asked questions
Is continuous monitoring required for CMMC Level 2? Yes in substance. Requirement CA.L2-3.12.3 asks you to monitor your security controls on an ongoing basis. The requirement does not prescribe a tool or a schedule, so you decide how to meet it and document that choice.
Does continuous monitoring replace a CMMC assessment? No. Monitoring helps you stay ready and gives your leadership a record to rely on for the annual affirmation. The assessment is performed by a certified assessor, and the assessor makes the determination.
How often should I review my controls? The requirement sets no frequency. Choose intervals you can sustain and match them to risk: alert triage daily, account and finding review weekly, access reviews quarterly, policy review annually is a common pattern. Write it into your procedures and follow it.
What counts as evidence of monitoring? Dated records that show a check ran, what it found, who followed up and when it closed. Assessors generally want to see repeated checks over time, not a single snapshot.
Can I do this with spreadsheets? Yes, if you keep them disciplined. The risk is staleness, falling behind schedule, and unclear change history, which is where most teams struggle.
Does a monitoring tool make me CMMC compliant? No tool does. A tool can collect and organize evidence. Whether an objective is met is the assessor’s decision.
See it on your own environment
If you want to see how this looks in practice, ask us for a walkthrough of Continu-US. We will show the verification matrix, a weekly status report and an evidence package built from your type of environment.
Continu-US verifies and evidences controls. It does not make an organization compliant or certified. Assessment decisions belong to the assessor. ATLLC is a C3PAO, and buying Continu-US does not influence or entitle anyone to a certification outcome.