CMMC Phase 2 November 2026: two readings of SR.1 — C3PAOs are applying the one that requires a verifiable chain, not just a file
Source Reddit Cybersecurity
Discussion
The upcoming CMMC Level 2 Phase 2 assessments starting November 2026 require demonstration of a verifiable chain of custody for software components, not just generation of a Software Bill of Materials (SBOM). Current SBOM tooling enumerates dependencies but does not capture provenance or review history of AI-generated code, creating a compliance gap. Organizations using AI-assisted code must implement controls to track AI code provenance and ensure human review to meet CMMC requirements. Failure to do so may result in non-compliance during mandatory third-party assessments.
r/cybersecurity (opens in a new tab)u/denzuko0 points0 comments
Generating an SBOM satisfies SR.1 as a checkbox. Demonstrating a verifiable chain of custody satisfies it as a control. If your program does the former and assessors are applying the latter, you have a five-month window.