Contributions
Implementation examples
Every example is tied to a specific control and, ideally, to the individual assessment objectives it claims to satisfy. Verdicts and reasoning are attached to each one.
3 examples referencing Git
- CA.L2-3.12.4[a] [b] [c] [e] [f] [g] [h]
SSP kept in version control: boundary diagram, per-practice narrative, quarterly refresh
AO coverage. Claims objectives [a], [b], [c], [e], [f], [g], and [h]. Out of scope for this example: [d] (identifying requirements approved as non-applicable) — this OSC's authorizing official has…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.3[a] [b] [c] [d]
Intended change versus actual change: reconciling tickets against what the tools logged
AO coverage. Addresses all four System Change Management objectives: changes are tracked [a], reviewed [b], approved or disapproved [c], and logged [d]. Tracking [a]. Every change to an in-scope…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - CM.L2-3.4.1[a] [b] [c] [d] [e] [f]
Baselines as code and one inventory of record, including firmware and the documents
AO coverage. Addresses all six System Baselining objectives: baseline established [a] and covering hardware, software, firmware, and documentation [b]; baseline maintained across the life cycle [c];…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 1