K06 assurance and procurement architecture
Mapping Quality Levels
Direct answer
K06 prevents a loose conceptual relationship from being presented as an exact requirement or compliance determination. Every current control mapping carries one of seven quality states.
Seven mapping-quality states
EXACT_REQUIREMENT
Exact requirement
The cited source imposes a directly matching requirement within confirmed scope.
0 current control mappings
Evidence required
- exact source text
- confirmed applicability
- implementation trace
- independent review
Allowed wording. implements the cited requirement when the stated scope is satisfied
Prohibited wording. certified or compliant without an authorized determination
PARTIAL_IMPLEMENTATION_SUPPORT
Partial implementation support
The control supports part of a requirement or objective but does not satisfy it alone.
25 current control mappings
Evidence required
- supported sub-requirement
- known gaps
- companion controls
- scope decision
Allowed wording. supports part of the objective
Prohibited wording. fully implements the framework
INFORMATIVE_RELATIONSHIP
Informative relationship
The source informs design or interpretation without creating an implementation claim.
96 current control mappings
Evidence required
- relevance rationale
- citation
- non-certifying boundary
Allowed wording. is informed by
Prohibited wording. meets or complies with
CONFLICT
Conflict
The source and proposed control impose incompatible expectations that require resolution.
0 current control mappings
Evidence required
- conflicting text
- affected scope
- decision owner
- resolution state
Allowed wording. conflicts with pending resolution
Prohibited wording. silently harmonized
SUPERSESSION
Supersession
A newer authoritative source replaces or materially revises an older mapping.
0 current control mappings
Evidence required
- successor source
- effective date
- affected mapping
- migration record
Allowed wording. superseded by
Prohibited wording. both current without qualification
NOT_APPLICABLE
Not applicable
A documented scope decision establishes that the source does not apply to the named facility, system, or activity.
0 current control mappings
Evidence required
- applicability analysis
- authority or counsel review
- scope facts
- review date
Allowed wording. not applicable to the named scope
Prohibited wording. irrelevant everywhere
UNRESOLVED_APPLICABILITY
Unresolved applicability
The available record is insufficient to decide whether the source applies.
5 current control mappings
Evidence required
- open question
- missing facts
- review owner
- next review condition
Allowed wording. applicability unresolved
Prohibited wording. assumed applicable or inapplicable
Application rule
A source relationship is recorded at the strongest quality the evidence supports. Exact requirement requires confirmed scope and exact text. Informative relationship cannot be described as compliance. Unresolved applicability remains unresolved until a competent review closes it.