Free tool · CMMC Level 2

Is your compliance still true today?

Your SSP says what you do. Your evidence proves it. The Drift Check compares the two by date and owner, so you can see what has gone stale since your last assessment. No score, no grading. Just your receipts.

Runs in your browser. Nothing is uploaded.

Upload your evidence register

Drop an .xlsx, .csv or .json file here. Any layout works: you’ll match the columns next. No register yet? Start from the template, with all 110 practices prefilled.

Choose file

Drift Report · Oct 16, 2026

Acme Precision Machining (example)

38 tracked · 1 marked N/A

Of 38 practices you track, 18 have a current receipt. 9 are overdue, 1 come due soon, and 7 can’t be shown as current yet because a date, receipt, or interval is missing. 3 are event-driven, so check those by hand.

Next 5 actions

17 tasks found in total

Refresh “Tabletop exercise after-action”

155 days overdue · backs IR.L2-3.6.3

Owner: J. Ortiz

TargetOct 30, 2026

Refresh “Badge system audit export”

108 days overdue · backs PE.L2-3.10.4

Owner: Assign an owner

TargetOct 30, 2026

Refresh “Privileged account review”

48 days overdue · backs AC.L2-3.1.5

Owner: R. Dalton

TargetOct 30, 2026

Refresh “KnowBe4 completion report”

45 days overdue · backs AT.L2-3.2.1

Owner: T. Nguyen

TargetOct 30, 2026

Refresh “Patch remediation tracker”

39 days overdue · backs RA.L2-3.11.3, SI.L2-3.14.1

Owner: R. Dalton

TargetOct 30, 2026

Ownership

6 inherited practices with no proof on file

Your MSP or cloud provider does the work, but your files need their evidence. Northline IT, Microsoft 365 GCC High, CSP.

2 with no owner

PE.L2-3.10.4, SC.L2-3.13.11

R. Dalton owns 34%

13 of 38 practices sit with one person. If they leave or are out during an assessment, those receipts go quiet.

2 with no interval defined

CM.L2-3.4.2, IA.L2-3.5.7. 800-171 leaves many intervals to you, so your SSP should say how often.

Next 12 months

Next affirmation

Oct 2026 (pick a month)

Weekly log review tickets AU.L2-3.3.5Oct 19, 2026

Nessus scan reports RA.L2-3.11.2Oct 21, 2026

VPN log review AC.L2-3.1.12Oct 26, 2026

Weekly log review tickets AU.L2-3.3.5Oct 26, 2026

Evidence doing double duty

One receipt backing several practices. Keep these current first; one lapse shows up in many places.

User access review – Q32

Patch remediation tracker2

ISO 9001 internal audit report · ISO 9001 9.22

Every receipt

Status	Practice	Evidence	Owner	Last	Next due
Overdue	IR.L2-3.6.3 Incident response testing	Tabletop exercise after-action 155 days overdue	J. Ortiz	May 14, 2025	May 14, 2026 Annual
Overdue	PE.L2-3.10.4 Physical access logs	Badge system audit export 108 days overdue · No owner	—	Mar 30, 2026	Jun 30, 2026 Quarterly
Overdue	AC.L2-3.1.5 Least privilege	Privileged account review 48 days overdue	R. Dalton	May 29, 2026	Aug 29, 2026 Quarterly
Overdue	AT.L2-3.2.1 Role-based risk awareness	KnowBe4 completion report 45 days overdue	T. Nguyen	Sep 1, 2025	Sep 1, 2026 Annual
Overdue	RA.L2-3.11.3 Vulnerability remediation	Patch remediation tracker 39 days overdue	R. Dalton	Aug 7, 2026	Sep 7, 2026 Monthly
Overdue	SI.L2-3.14.1 Flaw remediation	Patch remediation tracker 39 days overdue	R. Dalton	Aug 7, 2026	Sep 7, 2026 Monthly
Overdue	AT.L2-3.2.3 Insider threat awareness	Insider threat briefing sign-in 30 days overdue	T. Nguyen	Sep 16, 2025	Sep 16, 2026 Annual
Overdue	CA.L2-3.12.4 System security plan	SSP v3.1 15 days overdue	R. Dalton	Oct 1, 2025	Oct 1, 2026 Annual
Overdue	MP.L2-3.8.9 Protect backups	Backup restore test 8 days overdue	Northline IT MSP	Jul 8, 2026	Oct 8, 2026 Quarterly
Due soon	RA.L2-3.11.2 Vulnerability scan	Nessus scan reports Due in 5 days	Northline IT MSP	Sep 21, 2026	Oct 21, 2026 Monthly
No date	MA.L2-3.7.5 Nonlocal maintenance	Remote support procedure Inherited, no proof on file	Northline IT MSP	—	— Annual
No date	PE.L2-3.10.3 Escort visitors	Visitor log	K. Mercer	—	— Monthly
No date	SI.L2-3.14.2 Malicious code protection	EDR dashboard export	Northline IT MSP	—	— Monthly
No receipt	SC.L2-3.13.11 CUI encryption	— Inherited, no proof on file · No owner	— CSP	—	—
No receipt	SI.L2-3.14.6 Monitor communications for attacks	—	R. Dalton	—	—
No interval	CM.L2-3.4.2 Security configuration enforcement	GPO export	R. Dalton	Aug 17, 2026	—
No interval	IA.L2-3.5.7 Password complexity	Password policy GPO	R. Dalton	Mar 30, 2026	—
Event-driven	MP.L2-3.8.3 Media disposal	Media destruction certificates As needed · last Sep 1, 2026	K. Mercer	Sep 1, 2026	As needed
Event-driven	PS.L2-3.9.1 Screen individuals	Background check log As needed · last Sep 16, 2026	T. Nguyen	Sep 16, 2026	As needed
Event-driven	PS.L2-3.9.2 Personnel actions	Offboarding checklist As needed · last Oct 4, 2026	T. Nguyen	Oct 4, 2026	As needed
Current	AC.L2-3.1.1 Authorized access control	User access review – Q3 Next Nov 2, 2026	R. Dalton	Aug 2, 2026	Nov 2, 2026 Quarterly
Current	AC.L2-3.1.2 Transaction & function control	User access review – Q3 Next Nov 2, 2026	R. Dalton	Aug 2, 2026	Nov 2, 2026 Quarterly
Current	AC.L2-3.1.7 Privileged functions	SIEM audit config export Next Mar 30, 2027 · Inherited, no proof on file	Northline IT MSP	Mar 30, 2026	Mar 30, 2027 Annual
Current	AC.L2-3.1.12 Control remote access	VPN log review Next Oct 26, 2026	Northline IT MSP	Sep 26, 2026	Oct 26, 2026 Monthly
Current	AC.L2-3.1.20 External connections	Network diagram v4 Next Dec 20, 2026	R. Dalton	Dec 20, 2025	Dec 20, 2026 Annual
Current	AT.L2-3.2.2 Role-based training	Admin training certificates Next Jun 18, 2027	T. Nguyen	Jun 18, 2026	Jun 18, 2027 Annual
Current	AU.L2-3.3.1 System auditing	Log retention settings Next Jul 18, 2027	Northline IT MSP	Jul 18, 2026	Jul 18, 2027 Annual
Current	AU.L2-3.3.5 Audit correlation	Weekly log review tickets Next Oct 19, 2026 · Inherited, no proof on file	Northline IT MSP	Oct 12, 2026	Oct 19, 2026 Weekly
Current	CA.L2-3.12.1 Security control assessment	ISO 9001 internal audit report Next May 19, 2027	J. Ortiz	May 19, 2026	May 19, 2027 Annual
Current	CA.L2-3.12.2 Plan of action	POA&M tracker Next Nov 17, 2026	R. Dalton	Aug 17, 2026	Nov 17, 2026 Quarterly
Current	CA.L2-3.12.3 Security control monitoring	ISO 9001 internal audit report Next May 19, 2027	J. Ortiz	May 19, 2026	May 19, 2027 Annual
Current	CM.L2-3.4.1 System baselining	Baseline config workbook Next Feb 8, 2027	R. Dalton	Feb 8, 2026	Feb 8, 2027 Annual
Current	CM.L2-3.4.3 System change management	Change log Next Dec 30, 2026 · continuous, checked at 90 days	R. Dalton	Oct 1, 2026	Dec 30, 2026 Continuous (checked at 90 days)
Current	IA.L2-3.5.3 Multifactor authentication	MFA enrollment report Next Apr 19, 2027 · Inherited, no proof on file	Microsoft 365 GCC High CSP	Apr 19, 2026	Apr 19, 2027 Annual
Current	IR.L2-3.6.1 Incident handling	Incident Response Plan v2 Next Nov 20, 2026	J. Ortiz	Nov 20, 2025	Nov 20, 2026 Annual
Current	PE.L2-3.10.1 Limit physical access	Badge access roster Next Dec 16, 2026	K. Mercer	Sep 16, 2026	Dec 16, 2026 Quarterly
Current	RA.L2-3.11.1 Risk assessments	Annual risk assessment Next Jan 9, 2027	J. Ortiz	Jan 9, 2026	Jan 9, 2027 Annual
Current	SC.L2-3.13.1 Boundary protection	Firewall rule review Next Nov 19, 2026 · Inherited, no proof on file	Northline IT Shared	May 19, 2026	Nov 19, 2026 Semiannual

Keep a copy

Take the report with you

Both are made right here in your browser. No email, no account, nothing sent.

Stop checking by hand

Turn these dates into reminders that send themselves

Fettle runs every recurring review on its cadence, maps it to your controls, and alerts the right people before anything lapses, so the next Drift Check comes back clean.

Start free trial Book a 20-min review

How this stays private

We never see your register.

Read in your browser

Your file is opened by this page on your own computer. It is never uploaded, and it is gone when you close the tab.

Blocked from sending

This page's security policy forbids it from making network requests at all. No analytics, no tracking, no third-party scripts or fonts.

Check it yourself

Open your browser's developer tools, choose the Network tab, then upload a file. Nothing goes out. You can also disconnect from the internet first.

The Drift Check compares your own records to your own stated intervals. It does not assess whether a practice is implemented, estimate an SPRS score, or replace your prep provider, assessor, or affirming official. “Due soon” uses the same windows Fettle uses for recurring reviews (30 days for annual items, 21 semiannual, 14 quarterly, 7 monthly, 2 weekly). “Continuous” items are flagged when their latest evidence is more than 90 days old.