Methodology · White Paper

Audit-Ready by Default: Compliance Evidence Management with the Open Knowledge Format

What the CMMC Phase 2 suspension changes, what it does not, and why evidence discipline outlives the program that asks for it.

Author: Patrick Parker, CMMC Registered Practitioner — Altiri LLC · ORCID: 0009-0005-6819-5566 · July 2026

DOI: 10.5281/zenodo.21683193

Download PDF Jump to References

PDF upload pending — the link above will resolve to the hosted PDF once the file is uploaded. Until then, the paper is fully readable below.

Cite this paper

Cite this paper: Parker, P. (2026). Audit-Ready by Default: Compliance Evidence Management with the Open Knowledge Format. Zenodo. https://doi.org/10.5281/zenodo.21683193

Abstract
Paste region awaiting user-supplied text
Abstract (above-the-fold)
User-provided abstract drafted from Sections 1–3 is to be pasted here verbatim from chat. Do not paraphrase or rewrite.
Paper

Body — Sections 1 through 9

Section 1Section 1 heading (paste region)

Paste region awaiting user-supplied text
Section 1 body
User-provided Section 1 body is to be pasted here verbatim from chat.

Section 2Section 2 heading (paste region)

Paste region awaiting user-supplied text
Section 2 body
User-provided Section 2 body is to be pasted here verbatim from chat.

Section 3Section 3 heading (paste region)

Paste region awaiting user-supplied text
Section 3 body
User-provided Section 3 body is to be pasted here verbatim from chat.

Section 4Section 4 heading (paste region)

Paste region awaiting user-supplied text
Section 4 body
User-provided Section 4 body is to be pasted here verbatim from chat.

Section 5Section 5 heading (paste region)

Paste region awaiting user-supplied text — Meridian disclaimer preserved
Section 5 body
User-provided Section 5 body is to be pasted here verbatim from chat. The "every file in it is explicitly marked as fictional" disclaimer for the Meridian Machining example must be retained verbatim; do not strip it in any rendering pass.

Section 6Section 6 heading (paste region)

Paste region awaiting user-supplied text
Section 6 body
User-provided Section 6 body is to be pasted here verbatim from chat.

Section 7Section 7 heading (paste region)

Paste region awaiting user-supplied text
Section 7 body
User-provided Section 7 body is to be pasted here verbatim from chat.

Section 8Section 8 heading (paste region)

Paste region awaiting user-supplied text
Section 8 body
User-provided Section 8 body is to be pasted here verbatim from chat.

Section 9Section 9 heading (paste region)

Paste region awaiting user-supplied text
Section 9 body
User-provided Section 9 body is to be pasted here verbatim from chat.
References

References

  1. Reference 1 (paste region) — NIST SP 800-171 Rev 2 / NIST 800-171A. URL when supplied: [to be wired verbatim from user-supplied References list]
  2. Reference 2 (paste region) — WilmerHale client alert. URL when supplied: [to be wired verbatim from user-supplied References list] (Verification: WilmerHale URL TBD above — confirm resolves before ship.)
  3. Reference 3 (paste region) — DoD CIO CMMC About page. URL when supplied: https://dodcio.defense.gov/cmmc/About/ (Verification flagged: dodcio.defense.gov returned 403 to non-browser UA on 2026-07-30; page exists for general users but not automated resolvers. Review before ship.)
  4. Reference 4 (paste region) — FedRAMP. URL when supplied: [to be wired verbatim from user-supplied References list]
  5. Reference 5 (paste region) — ISO standard. URL when supplied: [to be wired verbatim from user-supplied References list]
  6. Reference 6 (paste region) — DoD CMMC FAQ. URL when supplied: [to be wired verbatim from user-supplied References list]
  7. Reference 7 (paste region) — Cornell LII False Claims Act overview. URL: https://www.law.cornell.edu/wex/false_claims_act
  8. Reference 8 (paste region) — Google Cloud OKF blog post (URL supplied by user) AND https://github.com/GoogleCloudPlatform/knowledge-catalog. (Verification: knowledge-catalog URL resolved 200 OK on 2026-07-30; the Google Cloud blog post URL is to be wired verbatim from the user-supplied References list.)
  9. Reference 9 (paste region) — Altiri OKF repository. URL: https://github.com/altiri-ai/okf-grc
  10. Reference 10 (paste region) — NIST AI 100-1 / AI RMF 1.0. URL: https://www.nist.gov/itl/ai-risk-management-framework (Verification: nist.gov/itl/ai-risk-management-framework resolved 200 OK on 2026-07-30; alternate canonical publication URL such as nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf 404s, so do not silently swap — flag this back to user instead.)
References — wording awaiting user-supplied text
Full citation strings
The wording for each reference entry (author, title, year, publisher) is to be pasted from the user's chat-supplied References list. URLs above are wired to the canonical landing pages verified to resolve on 2026-07-30 — any additional URLs the user supplies should be verified independently before ship.
FAQ

Frequently Asked Questions

Need broader CMMC advisory before standing up infrastructure?
Our CMMC advisory engagements cover gap assessment, SSP development, evidence collection, and full C3PAO coordination through certification.
See CMMC Advisory Services →
Want a focused conversation about OKF?
Tell us where your organization sits with NIST SP 800-171 evidence management and we'll route the right AltiriOS specialist to follow up.
Start a Consultation →