Compliance Runway: Close Your Gaps Before the Assessment

In brief: CMMC, HIPAA, FFIEC and NCUA exams, and PCI DSS 4.0 all come with a date, whether it's an assessment, an exam, an audit or a contract milestone. The problem usually isn't knowing what the framework requires. It's runway: closing gaps takes weeks, and most teams find out too late that they need more weeks than they have left. This guide explains how to measure your compliance runway, where each of the four frameworks stands in October 2026, the three questions almost every auditor asks, and how to check your own runway in about eight minutes with MALA's free Compliance Gap Check.

October is Cybersecurity Awareness Month, and this year's message is a blunt one: don't make it easy for them. Last week we looked at the risks you can't see. This week is about a risk everyone can see coming, and still gets caught by: the assessment date.

Every framework has one. A bank exam is on the calendar. A health system customer wants your HIPAA evidence before renewal. A prime contractor needs your SPRS score before it extends a subcontract. Your acquirer wants a PCI report on compliance. The date rarely moves in your favor, and it doesn't care how busy the quarter was.

What is compliance runway?

Compliance runway is the time between today and your next assessment, compared with the time it will realistically take to close your open gaps. If closing the gaps takes less time than you have, you have runway. If it takes more, you are already late, even if the assessment is months away.

The math is simple. Two adjustments make it honest:

• Subtract time for evidence. A control you finish the week before the assessment usually can't show the history an assessor wants to see. Reserve at least two weeks at the end to collect logs, screenshots, sign-offs and tickets.
• Remember that gaps don't close one at a time, and not all at once either. Most teams can work two or three remediation projects in parallel before they run out of people, change windows or provider capacity. Ten gaps that each take three weeks aren't three weeks of work. They're closer to ten.

Run the numbers and many teams discover the same thing: the assessment is ten weeks out, but closing the gaps takes fourteen, plus two for evidence. That is a six-week shortfall, and it was visible on day one to anyone who did the arithmetic.

The four frameworks below have different rules and different dates. Runway is the problem they share.

CMMC 2.0: defense contractors

CMMC has had a turbulent year. Phase 1 began on November 10, 2025, requiring Level 1 and Level 2 self-assessments in applicable contracts. Phase 2, which would have made third-party (C3PAO) certification the default for contracts involving controlled unclassified information from November 10, 2026, was suspended by the Department of Defense on July 13, 2026, pending a review of the program. As of this writing, it remains on hold.

It's tempting to read that as a reprieve. It isn't much of one. The suspension covers the third-party assessment requirement, not the underlying obligations. Contractors handling CUI still need to implement the 110 controls in NIST SP 800-171, keep an accurate score in SPRS, submit annual affirmations of compliance and meet DFARS 7012 incident-reporting rules. Many primes are still asking suppliers for proof, and the Justice Department continues to pursue False Claims Act cases over misrepresented security. If a third-party requirement returns, the contractors who kept going will be the ones with runway.

What assessors look at first

• A current System Security Plan that covers all 110 controls and matches what's actually deployed.
• Multifactor authentication on systems that store or process CUI, for both remote and privileged access.
• FIPS-validated encryption for CUI at rest and in transit, including backups.
• Central log collection with someone reviewing it, and flow-down of requirements to subcontractors.

HIPAA: healthcare organizations and their business associates

HIPAA doesn't hand you a single assessment date. Your dates come from elsewhere: an OCR investigation after a breach, a health system that audits its vendors before renewal, a cyber insurance application, or your own annual risk analysis. Because no one sets the date for you, it's easy to let the work drift until someone else does.

The rules are also getting more specific. HHS proposed the first major update to the HIPAA Security Rule in years, with explicit expectations for encryption, multifactor authentication, network segmentation, written and tested incident response plans, and more prescriptive risk analysis. The final rule is now listed for July 2027. Organizations that wait for the final text will be starting their remediation with the clock already running.

What assessors look at first

• A documented, current risk analysis, and evidence that findings were acted on.
• Access controls and audit logs for systems containing electronic protected health information.
• Business associate agreements for every vendor that touches patient data.
• Encryption of laptops, mobile devices and backups, and a tested way to restore them.

FFIEC and NCUA: banks and credit unions

Financial institutions have the most predictable dates of the four: the exam cycle. That predictability can be a trap, because the next exam always feels far away until the request letter arrives, and the list of items to produce is long.

The tools have shifted, too. The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions toward resources such as the NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals. The NCUA kept its Automated Cybersecurity Evaluation Toolbox (ACET) available for credit unions and said it would align ACET with those same resources. Either way, examiners still expect you to show that controls exist, that they work, and that you understand the third parties your operations depend on.

What examiners look at first

• A current self-assessment against a recognized framework, with a plan for the gaps it found.
• Multifactor authentication for remote access, privileged users and high-risk transactions.
• Third-party risk management for core processors, digital banking and managed service providers, including how they fail and recover.
• Business continuity and incident response plans that have been tested, not just written.

For the vendor side of that list, see our practical framework for third-party risk management.

PCI DSS 4.0: anyone who takes card payments

PCI DSS has a fixed annual rhythm: a report on compliance or a self-assessment questionnaire, plus quarterly scans. The newest pressure comes from version 4.0. Its 51 "future-dated" requirements, which organizations could treat as best practice for the first year, became fully applicable in assessments after March 31, 2025. For many merchants, this year's assessment is the first where all of them count.

Several of those requirements take real lead time, because they depend on new tooling or on providers: managing and monitoring the scripts that run on payment pages, detecting unauthorized changes to those pages, stronger authentication into the cardholder data environment, and documented targeted risk analyses that justify how often you perform certain controls.

What assessors look at first

• A current scope: where cardholder data flows, and which systems and providers touch it.
• Inventory and change detection for payment page scripts (requirements 6.4.3 and 11.6.1).
• Multifactor authentication into the cardholder data environment.
• Written targeted risk analyses wherever the standard lets you set your own frequency.

Three questions almost every auditor asks

The frameworks differ, but a handful of questions come up in nearly every assessment, exam and audit. If you can't answer these three with a confident yes and evidence to back it, start here:

1. Do you require MFA on every remote and admin login? Not most logins. Every one, including service desks, vendor access and the old VPN nobody wants to touch. Exceptions need to be documented and approved.
2. Have you actually tested a backup restore? Backups that have never been restored are a hope, not a control. Assessors want to see a dated test, how long the restore took, and what you fixed afterward.
3. Is your incident response plan written down? A plan that lives in one person's head fails the first time that person is on vacation. Write it, name the roles, and run a tabletop exercise at least once a year.

None of the three requires a new platform. All three take longer than people expect, because they depend on change windows, provider tickets and other teams' calendars. That's exactly why they belong at the front of the runway.

Why teams run out of runway

Gaps are rarely a surprise. Running out of time usually is. The causes are consistent:

• Evidence lags the control. A control finished last week has no history yet, and many assessors want to see it operating over time.
• Fixes depend on providers. Turning on MFA for a hosted application, getting FIPS-validated encryption from a cloud provider or adding payment page monitoring can mean a contract change or a support queue measured in weeks.
• Procurement takes longer than remediation. When a gap needs a new tool or service, budget approval, vendor selection and contracting often take longer than the deployment itself.
• The calendar fills up. Year-end change freezes, peak seasons and holidays remove weeks you thought you had.

A 30-day starting plan

You don't need to solve everything this month. You need to know where you stand and start the longest work first:

1. Week 1: Confirm the date and the scope. Write down the next assessment, exam or audit date for each framework that applies, and what's in scope for each.
2. Week 2: Score the gaps. Answer the control questions honestly, treating "not sure" as a gap, and estimate how long each fix takes.
3. Week 3: Do the runway math. Compare weeks needed with weeks left, minus two for evidence. Start the longest and most provider-dependent fixes now.
4. Week 4: Report it. Give leadership a one-page summary: your score, your top gaps, your runway and what you need from them to close the difference.

Check your runway in about eight minutes

MALA's free Compliance Gap Check does the runway math for you. Pick CMMC 2.0, HIPAA, FFIEC/NCUA or PCI DSS 4.0, answer 20 control questions, and enter your assessment date. You'll see a readiness score from 0 to 100, how many gaps are open, your top three, a breakdown by domain, and how the weeks needed to close your gaps compare with the weeks you have left.

It takes about eight minutes, and your results appear on screen with no signup. If you want the full remediation plan, with every gap ranked by risk and a week-by-week timeline sequenced to your assessment date, you can request it, and a MALA advisor can match each gap to providers who know your framework. It's a directional self-assessment, not a formal audit, and it's vendor-neutral: MALA is paid by providers, not by you.

Check my runway

Executive takeaways

• The question isn't whether you have gaps. It's whether you have enough weeks to close them before the date.
• Count weeks honestly: gaps close two or three at a time, and evidence needs time at the end.
• Regulatory dates shift, as CMMC showed this year, but the controls behind them don't. Keep going.
• Start with MFA, tested restores and a written incident response plan. Nearly every auditor asks about all three.

Frequently asked questions

What is a compliance gap assessment?

A compliance gap assessment compares the controls a framework requires with the controls you actually have in place, and lists the differences. A useful one also estimates how long each gap takes to close, so you can compare that with your assessment date.

Is CMMC still required if Phase 2 is suspended?

The suspension pauses the requirement for mandatory third-party certification. Contractors handling CUI still need to implement NIST SP 800-171, maintain an accurate SPRS score, submit annual affirmations and complete Level 1 or Level 2 self-assessments where contracts require them. Check your contract language and prime flow-downs in writing, and confirm specifics with your contracting officer or counsel.

What replaced the FFIEC Cybersecurity Assessment Tool?

The FFIEC retired the tool on August 31, 2025, and pointed institutions to resources such as the NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals. Credit unions can continue to use the NCUA's ACET, which the NCUA is aligning with those resources.

Which PCI DSS 4.0 requirements became mandatory in 2025?

The 51 future-dated requirements introduced in version 4.0 became fully applicable in assessments after March 31, 2025. They include payment page script management and change detection, stronger authentication into the cardholder data environment, and targeted risk analyses.

Is the Compliance Gap Check really free?

Yes. It takes about eight minutes, needs no signup to see your results, and is a directional self-assessment rather than a formal audit or legal opinion.

About the author: Eric Anderson is the Founder and President of MALA Technology Advisors. After two decades working with organizations ranging from early-stage startups to Fortune 500 enterprises, he saw the same pattern repeat: significant technology decisions being made without independent, vendor-neutral expertise at the table. He founded MALA to close that gap, and now leads its advisory practice across cybersecurity, cloud, AI infrastructure, and technology procurement.