CMMC is the domain. EVE governance signals are the reusable verification layer.
The Cybersecurity Maturity Model Certification (CMMC) verifies that defense contractors have implemented security requirements to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). EVE does not implement CMMC, and EVE is not a CMMC assessment tool. EVE provides a set of deterministic governance signals — each following the same pattern: a declared rule, observed activity, deterministic evaluation, human review gate, and a sealed, cryptographically verifiable decision record.

The five signals built in the TPRM context apply to CMMC governance questions without modification to the signal model. The domain changes. The verification pattern does not.
Responsibility boundary
EVE records what evidence exists, what evidence is missing, which declared controls were evaluated, who reviewed the result, and what was sealed. EVE does not assess, score, certify, or determine CMMC compliance, and is not a substitute for a C3PAO assessment. All signal proofs shown are synthetic demonstrations, not real assessment findings.
Scope. This page maps EVE governance signals to CMMC Level 2, which currently maps to NIST SP 800-171 Rev. 2 (110 security requirements across 14 families). References below use Rev. 2 family numbering (3.1–3.14). Family-level references are the primary mapping; specific practice IDs (e.g. 3.4.3) are shown only as illustrative examples, not as claims of control coverage.
The same verification pattern — applied to CMMC governance
1
Declared rule
2
Observed activity
3
Deterministic evaluation
4
Human review
5
Sealed decision record
6
Public verification
1
Authority Boundary
Did the action stay within the declared authority of the responsible role or account?
Live · v0CMMC mapping
What it evaluates
Whether an action exceeded the declared authority limit for that actor, action type, and context. Each limit is declared by the organisation; EVE compares the observed action to the declared threshold. Verdict is breach if exceeded, pass if within, unknown if the actor, action, or limit cannot be resolved (fail-closed — never treated as pass).
CMMC governance question
Did an action stay within the declared authority of the responsible role or account? Access control and identity governance limit what each role or account is authorised to do. The Authority Boundary signal surfaces whether an observed action was within the declared authority of the responsible function.
3.1 Access Control 3.5 Identification & Authentication
Illustrative practice example: 3.1.5 (least privilege). Family-level mapping is the primary reference.
Output verdicts
breachpassunknown
unknown → actor, action, or limit unresolvable. Never a pass.
Domain proof — sealed on EVE Bridge
EVE-CMMC-00004297 breach / authority_limit_exceeded → helpdesk role performed a privileged admin account action above declared authority · Human decision: reject Verify publicly →
Synthetic CMMC demo proof — shows the Authority Boundary mechanism in a CMMC context. Not a real assessment finding, not a C3PAO assessment.
2
Approval Chain
Was the declared approval chain satisfied before the change, configuration action, or risk acceptance?
Live · v0CMMC mapping
What it evaluates
Whether a declared sequence of approvals was satisfied — in order, by the declared approver identities, and before the associated action occurred. Missing approver identity, wrong order, or approval recorded after the action produces unknown or breach respectively.
CMMC governance question
Was the declared approval chain satisfied before the change was applied? Configuration change control requires changes to be tracked, reviewed, and approved before implementation, with the activity logged. The Approval Chain signal surfaces whether the declared approval sequence was completed before the associated change was recorded.
3.4 Configuration Management 3.3 Audit & Accountability
Illustrative practice example: 3.4.3 (track, review, approve or disapprove, and log changes). Family-level mapping is the primary reference.
Output verdicts
breachpassunknown
unknown → missing approval evidence or identity. Never a pass.
Domain proof — sealed on EVE Bridge
EVE-CMMC-00004298 breach / approval_after_action → change_board_approval recorded after the system change was applied · Human decision: reject Verify publicly →
Synthetic CMMC demo proof — shows the Approval Chain mechanism in a CMMC context. Not a real assessment finding, not a C3PAO assessment.
3
Overlapping Boundary
Did all declared applicable controls evaluate against this event — and did any fail?
Live · v0CMMC mapping
What it evaluates
A composition layer: each action or event carries the set of declared controls that apply to it. EVE verifies coverage (every applicable control was evaluated) and composes the verdicts. Propagation order: breach > unknown > pass. One failing control is enough for a breach; an unevaluated control produces unknown, which propagates upward and is never treated as pass.
CMMC governance question
Were all declared applicable controls evaluated, and did any fail or go unevaluated? Security assessment and system integrity monitoring require that applicable controls are periodically assessed and that their status is known. The Overlapping Boundary signal surfaces whether all controls declared applicable to an event were evaluated and whether any produced a finding — mirroring the requirement that every declared control has a known status, never an unexamined one.
3.12 Security Assessment 3.14 System & Information Integrity
Illustrative practice example: 3.12.1 (periodically assess security controls). Family-level mapping is the primary reference.
Output verdicts
breachpassunknown
unknown propagates upward from any unevaluated control.
Domain proof — sealed on EVE Bridge
EVE-CMMC-00004299 unknown / unevaluated_boundary → config_baseline_check could not be evaluated; unknown is not pass · Human decision: reject (held for review) Verify publicly →
Synthetic CMMC demo proof — shows the Overlapping Boundary mechanism (unknown path) in a CMMC context. Not a real assessment finding, not a C3PAO assessment.
4
Collective Outcome
Did individually acceptable events produce an unacceptable combined outcome within a declared window?
Live · v0CMMC mapping
What it evaluates
The first cross-action layer: within one declared window, EVE evaluates whether different individually-acceptable events combine into a declared-unacceptable state. Each event may be within its own limit — the breach is in the combination, not the count. Groups are evaluated independently. Missing window, group key, or value produces unknown for that group.
CMMC governance question
Did individually acceptable events sum to a collectively unacceptable risk outcome within a declared window? Risk assessment requires periodic evaluation of risk, including risk that emerges from the combination of individually minor events. The Collective Outcome signal surfaces whether individually sub-threshold events aggregate to a collectively unacceptable result within a declared window.
3.11 Risk Assessment 3.3 Audit & Accountability
Illustrative practice example: 3.11.1 (periodically assess risk). Family-level mapping is the primary reference.
Output verdicts (per group)
breachpassunknown
breach when aggregate > limit. Equal to limit = pass.
Domain proof — sealed on EVE Bridge
EVE-CMMC-00004373 breach / collective_unauthorised_access_state → cui_enclave: privileged access granted + MFA exception active + vendor risk unresolved — each individually permitted, but the combined effective access state is not authorised · Human decision: reject (remediation required) Verify publicly →
Synthetic CMMC demo proof — shows the Collective Outcome mechanism in a CMMC context. Not a real assessment finding, not a C3PAO assessment.
5
Accumulation Risk
Did repeated minor events accumulate beyond a declared threshold over a rolling window?
Live · v0CMMC mapping
What it evaluates
A rolling-window cumulative layer: EVE sums a declared field for the same kind of repeated event, for a declared group-by key, over a declared window anchored to a declared as_of reference point (never wall-clock time). A single event may be below any individual threshold while the rolling sum over time constitutes a breach. Out-of-window events are excluded. Events with unresolvable timestamps or group keys produce unknown (fail-closed).
CMMC governance question
Did repeated minor events accumulate beyond a declared threshold over a rolling window? Audit and accountability requires correlating audit records across time for investigation and response, and incident response requires handling events that may individually appear minor. The Accumulation Risk signal surfaces whether individually sub-threshold events have accumulated beyond a declared rolling limit.
3.3 Audit & Accountability 3.6 Incident Response
Illustrative practice example: 3.3.5 (correlate audit record review, analysis, and reporting). Family-level mapping is the primary reference.
Output verdicts (per group)
breachpassunknown
unknown: unresolvable timestamp, group key, or non-numeric value.
Domain proof — sealed on EVE Bridge
EVE-CMMC-00004301 breach / accumulation_limit_exceeded → fileserver_01 minor audit anomalies 40+35+30=105 > limit 100 over 90-day window · no single-anomaly breach · Human decision: reject Verify publicly →
Synthetic CMMC demo proof — shows the Accumulation Risk mechanism in a CMMC context. Not a real assessment finding, not a C3PAO assessment.
What these five signals do not address
These five governance signals map to a subset of NIST SP 800-171 Rev. 2 families. They do not address the following families, which require their own controls, evidence, and assessment and are out of scope for the signal layer:
3.2 Awareness & Training 3.7 Maintenance 3.8 Media Protection 3.9 Personnel Security 3.10 Physical & Environmental Protection 3.13 System & Communications Protection
Illustrative governance-level mapping — not an assessment
The NIST SP 800-171 Rev. 2 references on this page are indicative, governance-level mappings only. They identify the governance question each EVE signal addresses in a CMMC context. They are not a control-by-control implementation, not a gap assessment, not an assessment-readiness determination, and not legal advice.

All sealed EVE-IDs that will appear on this page are produced against synthetic fixture data and labelled accordingly. They demonstrate the verification mechanism — not CMMC-specific findings. No customer, partner, or production data is used or exposed anywhere on this page.

EVE does not assess, score, certify, or determine CMMC compliance. EVE does not produce or contribute to a CMMC certification. EVE is not a substitute for a C3PAO assessment. Human review and a qualified assessor remain required for all CMMC obligations.