Maintain compliance when the work changes

One questionnaire or assessment does not finish the work. Defense contracts, systems, people, and suppliers change. A new subcontract may introduce different information. A software change may move the system boundary. A departing administrator may change access.

Ask what changed, which requirement it touches, and whether the implementation and evidence still support the answer your team gives.

Deep Fathom Updated September 13, 2026

Create review triggers your team will notice

RTX’s supplier guidance calls for maintaining and updating a written security program, as well as keeping applicable status information current. That connects everyday safeguards to the answer a customer receives. RTX supplier guidance.

Use operating events, not calendar reminders alone. Review the affected record when:

A new award, amendment, or flowed-down requirement changes the work.
Your team receives, creates, stores, or shares a different category of customer information.
A covered system, service provider, identity process, location, or network connection changes.
Responsibility for implementation, evidence, or the customer response moves to someone else.
A customer asks again for status, evidence, a self-assessment, an affirmation, or a different response.

Keep each trigger with an owner. The owner does not need to rerun the entire program every time. They need to establish whether the change affects scope, implementation, evidence, or the required response.

Use a four-part change review

Record the change

State what happened, when it happened, and which contract or work it affects. This creates the starting point for a focused review.
Check the scope

Identify the systems, information, people, and lower-tier relationships involved. A change outside the original boundary may need a new record.
Decide the work

Determine whether the implementation needs an action, approval, or outside support. Assign the next step and its owner.
Update the record

Identify the evidence or customer response that needs an update, replacement, or explanation. Keep the reason for the review with the revised material.

Consider a supplier that moves a project team to a new collaboration service. The old access-review record remains useful history. It does not establish that the new service has the same configuration, accounts, retention settings, or handling practices. A focused review identifies the gap, assigns work, and preserves why the team revisited the record.

Apply the same discipline when a policy changes. Establish whether it affects the governing terms, implementation, or required response. The verification and current-status guide explains the current policy context. Keep the maintenance routine tied to work your organization must continue to perform.

Keeping this work current lets your team give customers an accurate compliance update.

Deep Fathom keeps requirements, accountable work, evidence, SSP, and POA&M in one operating record. When a customer review or affirmation needs a dated point-in-time record, a sealed snapshot preserves the project state for later comparison. A snapshot does not decide compliance, certification, or customer acceptance.

Bring one changed contract, system, or customer request and the record it affects to a platform evaluation conversation. See how to check evidence before you reuse it. Return to the hub.

In Deep Fathom

Keep a dated record for later review.

Inspect the records saved in a snapshot, grouped by type. A saved state shows what was captured; it does not establish certification.

Maintain compliance when the work changes

Create review triggers your team will notice

Use a four-part change review

Record the change

Check the scope

Decide the work

Update the record

Keep a dated record for later review.

Put the requirements into practice.

Build compliance around the work you perform

Understand the requirements attached to your defense work

Check what your existing evidence supports before starting again

See how Deep Fathom fits your work.