Audit-Ready Evidence for CMMC: Why Screenshots Aren’t Enough

"Trust Me" Doesn't Pass CMMC — Proof Does

CMMC readiness is about more than putting controls in place. Organizations also need to show that those controls are working as intended in the real environment. In practice, that means being able to demonstrate not only that security requirements exist on paper, but that they are operating consistently across the systems, users, and workflows involved in handling FCI and CUI.

That is why evidence is so important. Policies, screenshots, and spreadsheets can support the story, but they rarely tell the full story on their own. They do not usually prove continuous protection, operational consistency, or alignment to the System Security Plan (SSP). Strong evidence is repeatable, traceable, time-bound, and produced through normal operations, not stitched together right before an assessment.

CMMC Is a Verification Program

CMMC is not based on intent alone. It is built around verification.

“The Defense Industrial Base has been saying, ‘trust me’ for the past 10 years. The whole reason the CMMC program had to be put into effect is because the DoD found out that 'trust me' wasn’t working,” explained Marc Zurcher, Managing Principal at Coalfire.

That gets to the heart of the model. CMMC exists to confirm that required cybersecurity practices are in place and functioning — not simply to accept that they are. Assessments are designed to evaluate whether controls are implemented properly, operating as intended, and producing the expected result.

The Problem with Last-Minute Evidence

Many organizations do not think seriously about evidence until late in the readiness process. That often leads to weak proof and unnecessary stress.

“If you have a screenshot, it proves that something was true for a certain period of time, but it doesn’t actually show any repeatable effective proof. A manual export from a system is just proof that somebody remembered to export it, like the day before an audit.” ~ Lansing Nye-Madden, Solutions Engineer at Fortra

Screenshots capture a moment. Spreadsheets show that someone manually collected information. Policies show intent. But assessors need more than snapshots and statements. They need evidence that a control is working consistently in the live environment and across the defined CMMC scope.

When evidence is gathered at the last minute, it is often:

• Incomplete
• Inconsistent
• Insufficient
• Outdated
• Difficult to trace
• Misaligned with the SSP
• Detached from real CUI flows

The result is a weaker compliance narrative and a more difficult assessment experience.

What Makes Evidence Strong?

Strong CMMC evidence typically has five qualities:

1. Repeatable: It can be produced again through the same operational process rather than recreated from memory or assembled manually for the assessment.
2. Traceable: It connects activity back to specific users, systems, assets, and policies. That is especially important when the assessment depends on clearly defined scope and documented treatment of in-scope assets.
3. Time-bound: It shows that controls are functioning over time, not just that they existed on one particular day.
4. Aligned to the SSP: The evidence supports what the SSP says about the environment, system boundary, and implementation of requirements.
5. Reflective of actual operations: The best evidence is generated as part of day-to-day work, with controls operating in the background as employees interact with CUI.

Weak Evidence vs. Strong Evidence

Weak evidence is not always useless, but it is often insufficient on its own.

Weak evidence

• Screenshots of settings
• Manually built spreadsheets
• One-time exports
• Verbal explanations
• Policies without supporting logs
• Point-in-time user lists

Strong evidence

• Centralized audit logs
• DLP enforcement records
• Classification metadata
• MFA authentication logs
• Access review history
• Configuration baseline evidence
• Change management tickets
• Incident response records
• System-generated reports mapped to SSP sections

Image

The difference is straightforward: Strong evidence does more than show that a control exists. It shows that the control is being used consistently where CUI actually lives and moves.

Evidence Starts with Scope

Evidence issues often begin with scoping issues.

Before an assessment, organizations need to define the CMMC scope clearly, including which assets process, store, or transmit CUI and which assets help protect that environment. If that work is incomplete, evidence collection becomes inconsistent from the start.

If an organization does not know where CUI resides or how it moves, it cannot know where evidence should come from.

For example, if CUI flows through email, endpoints, file shares, cloud repositories, and print workflows, then evidence may be needed from each of those areas. If the SSP says email is out of scope, but logs show CUI moving through mailboxes, the evidence and documentation are no longer aligned.

That is why evidence planning should begin as soon as CUI discovery and scoping begin.

Evidence and CUI Marking

CUI marking and classification can significantly improve evidence quality by making it easier for security systems to identify what requires protection and what activity should be logged.

“DLP logs of user activity and enforcement records when your controls actually fired are all audit-ready proof that you’re generating through this step of the process,” explained Nye-Madden. “It’s not just what’s on the document, but it’s how the data lives and moves within your environment.”

Official guidance makes clear that CUI markings help signal the presence of sensitive information and indicate that handling or dissemination controls may apply. When that information is marked consistently—and especially when metadata is involved — it creates a stronger chain of evidence across the environment.

For example:

• Classification tools can show when data was identified or marked
• DLP logs can show how that data moved
• Email controls can show whether it was blocked, encrypted, or redirected
• Endpoint and cloud controls can show whether it was handled appropriately

Evidence and the System Security Plan

The SSP anchors the assessment narrative.

It explains the system boundary, operating environment, implementation approach, and relevant relationships between systems. That makes it one of the most important reference points during a CMMC assessment.

A strong SSP should be written with evidence in mind from the beginning. For every major claim in the SSP, organizations should ask:

• What does the SSP say we do?
• Which system or process proves we do it?
• Who owns that evidence?
• How often is it generated?
• How long is it retained?
• Does it cover all in-scope assets?

When the SSP, the evidence, and the interview narrative all line up, the assessment becomes far more defensible.

Build an Evidence Plan from Day One

A practical evidence plan should include:

• Evidence inventory: source, owner, frequency, retention period, and mapped requirement
• Evidence automation: collection through normal operations wherever possible
• Evidence review cadence: regular review on a schedule, not just before assessment
• Evidence retention: logs and records kept long enough to support assessment needs
• Evidence normalization: consistent timestamps, usernames, and asset identifiers
• Evidence narrative: documentation that explains why each artifact matters and which requirement it supports

Practical CMMC evidence checklist

Use this checklist to evaluate readiness:

• Does every SSP claim have supporting evidence?
• Can each piece of evidence be tied to in-scope systems?
• Can evidence be associated with specific users or roles?
• Does the evidence demonstrate operation over time?
• Are CUI data flows reflected in the evidence?
• Are DLP and classification events being retained?
• Are access reviews documented?
• Are exceptions being tracked and resolved?
• Can interviewees clearly explain the evidence?

If the answer to several of these questions is no, the issue may not be the control itself. It may be the way evidence is being collected, connected, and presented.

Make Evidence a Core Part of Readiness

CMMC raises the standard from documented intent to demonstrated performance. Organizations that treat evidence as an afterthought often struggle to show that controls are operating consistently across the systems, users, and workflows that matter most.

A stronger approach is to make evidence part of the program from the start — grounded in scope, aligned to the SSP, and generated through day-to-day security operations. That not only supports a smoother assessment but also reflects a more mature and defensible cybersecurity posture.