K05 assurance architecture
Evidence supports readiness without overclaiming
Direct answer
Every public or procurement readiness state is traceable to exact releases, tests, defects, deployment identity, authority, incidents, uptime, restoration, and independent-verification status.
Evidence boundary. These records describe architecture, control relationships, test requirements, and legal-source status. They do not certify a facility, authorize a mission, prove deployment, or replace current facility-specific engineering and legal review.
Claim
Every public or procurement readiness state is traceable to exact releases, tests, defects, deployment identity, authority, incidents, uptime, restoration, and independent-verification status.
Argument
Architecture, code, a signature, or a successful demonstration proves only a bounded property; evidence must match the claim being made.
Evidence requirements
- release hash
- SBOM
- test coverage
- defect and waiver records
- deployment record
- uptime window
- incident history
- independent verification
- last observation
Assurance defeaters
- missing artifact
- stale verification
- unresolved critical defect
- unknown deployment identity
- unavailable incident log
- marketing statement exceeds evidence
Hazards
- false procurement confidence
- unsafe deployment
- unreviewed residual risk
- loss of public trust
Recovery objectives
- downgrade readiness automatically
- publish correction
- suspend affected claim
- restore evidence chain
Site-tailoring questions
- mission assurance level
- customer acceptance criteria
- regulatory recordkeeping
- classified evidence boundary
Sources and record
PROV-O: The PROV Ontology · NIST SP 800-218 Secure Software Development Framework Version 1.1