What exactly did Secureframe change?
Four items in October. The evidence lookback in the Audit Module, with the sliding scale above and a note that evidence must still reflect actual practice and meet the audit's requirements. A dedicated Custom tests tab listing every test a customer has created, including unmapped ones. Virtual Desktop environments that deploy in about 30 minutes. And a free CMMC gap assessment on CMMC.com. The first two are the ones that touch a switch.
Why does a lookback matter for switching?
Our switch guide on timing a switch around your audit window says the auditor needs continuous evidence for the period under review, so moving mid-period is the risk. A lookback softens one side of that. If your next audit uses a three-month window, evidence from up to six months before the window may be considered, which means the months spent on the old platform before a move are not necessarily wasted. It does not help a twelve-month Type II, where no lookback applies.
How do the other platforms handle this?
We do not know from their pages. Evidence period rules are an audit-module detail that no vendor in our lineup publishes on a pricing or product page, and Secureframe published this one in a changelog. Ask each target vendor two questions: can evidence imported from another platform be dated to when it was collected, and does its audit module accept evidence from before the observation period. Get the answer in writing, then confirm it with your auditor, who decides what is accepted.
What about custom tests?
The new Custom tests tab matters because custom tests are the thing most often lost in a switch. They encode how your environment differs from the template. Before you leave any platform, export the list of custom tests, their mapping to controls and their last results; Secureframe's tab now makes that list visible in one place, which is what to ask for from the platform you are leaving.
Does this change our scores?
No. Audit path on this site scores the audit route a vendor publishes (partner network, built-in audit, in-house auditors), not the mechanics of evidence windows. We have added the two evidence questions above to the audit section of the switch planner.
What else should a switcher know?
Does Secureframe accept evidence from before the observation period?
Per its October 2026 product updates, up to six months before for a three-month audit window and up to three months before for a six-month window; none for nine- or twelve-month windows.
Does evidence from my old platform count after a switch?
It depends on the new platform's audit module and on your auditor. Ask whether imported evidence keeps its collection date and whether a lookback applies.
Which sources did we use?
Source: Secureframe product updates, October 2026 · read 2026-11-05