What CMMC Evidence Should You Retain?
By Chuck Lerch, Founder and CEO, Cyberuptive ·
Retain final artifacts used to support the assessment, with context identifying scope, ownership, and integrity. For Cybersecurity Maturity Model Certification (CMMC) Level 2 certification assessments, 32 CFR 170.17(c)(4) requires hashed evidence retention for six years from the CMMC Status Date (32 CFR 170.17(c)(4)). Hashing does not protect confidentiality (CMMC Hashing Guide v2.13).
Evidence retention is not an instruction to copy every file into an assessment folder. The CMMC Level 2 Assessment Guide v2.13 focuses on evidence that supports applicable assessment objectives and is final rather than draft (CMMC Assessment Guide Level 2 v2.13). Our recommended approach separates assessment selection, protected custody, and proof of integrity.
What are the key takeaways?
- Final, official evidence matters; drafts and unapproved policies do not support a MET finding (CMMC Assessment Guide Level 2 v2.13).
- The certification retention period runs from the CMMC Status Date under the regulation (32 CFR 170.17(c)(4)).
- Hashing establishes an integrity reference, not encryption or confidentiality (CMMC Hashing Guide v2.13).
- Agree provider handover and access responsibilities before an assessment or contract exit.
Which artifacts belong in the retained set?
Retain the evidence selected for the assessment and the context needed to understand it. The Level 2 guide describes examination, interviews, and tests, with assessment objects including documents, mechanisms, activities, and people (CMMC Assessment Guide Level 2 v2.13). It does not prescribe one universal folder of documents for every contractor.
Begin with an evidence index aligned to the assessment scope and objectives. For each item, record a meaningful name, the relevant system or process, an owner, its approved version, and where the protected original is retained. This index is our recommended management method, not a substitute for the assessor’s evidence judgment.
A screenshot without context can be difficult to interpret later. Preserve the context needed to establish what it shows, such as the system, date, configuration area, and approval record. Avoid capturing unrelated sensitive content merely because it happens to be visible on the same screen.
How do you distinguish final evidence from working material?
Use the approved, operative version of a policy or record. The assessment guide says evidence supporting a MET result must be final and excludes working papers, drafts, and unofficial or unapproved policies (CMMC Assessment Guide Level 2 v2.13). A polished draft remains a draft if the organization has not adopted it.
We recommend keeping preparation work separate from the final assessment set. A working checklist may help the team organize collection, but it should not be mislabeled as proof that a process operates. When a document is finalized, record its approval and preserve the version actually examined.
Apply the same discipline to exports and demonstrations. Note the collection parameters and the evidence owner’s review. If an export omits a relevant part of the assessment scope, document the omission rather than allowing a filename such as “complete inventory” to imply coverage it does not have.
| Record | Purpose | Recommended handling |
|---|---|---|
| Final artifact | Supports an assessment objective | Retain the selected version in controlled storage |
| Evidence index | Explains scope, owner, and location | Link to originals instead of multiplying copies |
| Hash manifest | Provides an integrity reference | Preserve algorithm and returned values |
| Working draft | Supports preparation | Keep distinct from accepted final evidence |
What does hashing prove, and what does it not prove?
A hash can help determine whether a retained artifact has changed since the integrity reference was created. The CMMC Artifact Hashing Tool User Guide v2.13 describes SHA-256 hashing and explicitly says hashing does not provide confidentiality (CMMC Hashing Guide v2.13). SHA-256 is a Secure Hash Algorithm with a 256-bit output.
Protect the evidence independently of its hash. Our recommendation is to restrict storage access, protect transfer channels, and retain auditability appropriate to the sensitivity of the records. A hash attached to an unprotected file does not make unrestricted sharing acceptable.
The guide distinguishes self-assessments from assessments performed by authorized assessment organizations: artifact hashing is not required for self-assessments under that guide (CMMC Hashing Guide v2.13). Confirm the assessment type and governing requirements with the assessment team rather than applying one workflow indiscriminately.
How long should the organization retain evidence?
For Level 2 certification, the regulation requires the organization seeking certification to retain hashed artifacts for six years from the CMMC Status Date (32 CFR 170.17(c)(4)). Use the regulatory trigger when establishing the retention schedule, and distinguish that schedule from ordinary operational-log retention.
Our recommended retention record identifies the assessment, status date, accountable custodian, protected storage location, and planned disposition review. If another legal or contractual duty requires longer preservation, coordinate that decision with counsel and the responsible contracting team.
Do not promise that an outsourced provider’s default retention setting satisfies this obligation. Ask whether selected assessment artifacts remain accessible after service termination, product migration, or a change of administrator. Test retrieval of a representative retained artifact before treating the storage arrangement as dependable.
How can you reduce unnecessary CUI copies?
Collect the evidence needed for the objective and manage its sensitivity explicitly. Controlled Unclassified Information (CUI) should not be copied into extra locations merely for convenience; our recommendation is to review each proposed evidence destination against the organization’s approved handling and assessment boundary.
Ask whether a demonstration, controlled view, or narrower export can establish the required fact without creating an unnecessary duplicate. Coordinate that choice with the assessor. Do not redact or alter an artifact in a way that removes information needed to evaluate the objective.
The hashing guide explains that assessment teams do not take or retain the organization’s proprietary artifacts offsite at the end of the assessment and that the organization retains custody (CMMC Hashing Guide v2.13). Translate that distinction into a clear collection and access procedure, rather than assuming the assessor or service provider becomes your permanent evidence archive.
What should a provider contract say about evidence?
Define who produces, reviews, retains, retrieves, and hands over each evidence category. Our suggested contract checklist covers selected artifacts, export formats, access permissions, approved destinations, restoration testing, and termination assistance. These are procurement recommendations, not additional CMMC requirements.
Ask the provider to demonstrate how you will retrieve a final artifact and its integrity record without relying on one employee’s personal account. Agree how sensitive material is transferred and who approves any new destination. Keep the retained assessment set distinguishable from the provider’s mutable working systems.
Our U.S.-based security operations center (SOC) would help identify relevant operational records while the contractor and assessment team determine sufficiency and custody. Start with CMMC readiness support, compare the CMMC responsibility matrix guide, and use the CMMC readiness checklist to assign responsibilities.
What else should buyers and operators know?
Can draft policies count as final evidence?
The Level 2 guide excludes drafts, working papers, and unofficial or unapproved policies from evidence supporting a MET result (CMMC Assessment Guide Level 2 v2.13).
Does hashing encrypt an artifact?
No. The hashing guide separates integrity from confidentiality and says confidentiality requires a separate mechanism (CMMC Hashing Guide v2.13).
Who retains certification evidence?
For Level 2 certification, the organization seeking certification retains the hashed artifacts for six years from the CMMC Status Date (32 CFR 170.17(c)(4)).
Should we collect every operational record?
We recommend selecting relevant evidence with the assessment team rather than indiscriminately copying records. The assessment guide allows different objects and methods to support applicable objectives (CMMC Assessment Guide Level 2 v2.13).
What is the next step for your organization?
Bring your scope, current evidence, and unresolved responsibilities to a focused discussion. Get a CMMC readiness assessment or Call 833-92-CYBER to clarify the next practical actions.