{
  "acceptanceEvidence": [
    "exact source references",
    "scope owner approval",
    "gaps and compensating measures",
    "review cadence"
  ],
  "acceptanceMatrix": [
    {
      "acceptanceState": "PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale",
      "assessmentMethod": "mapping validation",
      "criterion": "Applicability explicit",
      "requiredResult": "Every control is exact, partial, informative, conflicting, superseded, not applicable or unresolved"
    },
    {
      "acceptanceState": "PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale",
      "assessmentMethod": "citation replay",
      "criterion": "Source precision",
      "requiredResult": "Mappings cite exact current source sections"
    },
    {
      "acceptanceState": "PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale",
      "assessmentMethod": "language audit",
      "criterion": "No certification leap",
      "requiredResult": "Control selection is not represented as compliance"
    }
  ],
  "bidEvaluationCriteria": [
    "framework interpretation competence",
    "source-currentness process",
    "ability to document non-applicability",
    "control-neutral architecture",
    "price realism and schedule credibility",
    "data-rights and evidence-delivery terms",
    "subcontractor and supply-chain transparency"
  ],
  "canonicalUrl": "https://xn--mwe.com/procurement/work-packages/control-tailoring/",
  "dataRequirements": [
    "applicable authority and contract scope",
    "facility pattern and site facts",
    "source requirements",
    "architecture findings",
    "risk and license conditions"
  ],
  "deliverables": [
    "tailored control baseline",
    "mapping-quality register",
    "not-applicable decisions",
    "conflict and supersession log",
    "implementation evidence plan"
  ],
  "dependencies": [
    "WP-K06-03"
  ],
  "evidenceRights": [
    "The acquiring authority receives perpetual access to final reports, schemas, manifests, acceptance evidence, defects, and correction history within the negotiated data-rights regime.",
    "Contractor proprietary methods may remain protected only when they do not prevent independent replay of required results.",
    "Source artifacts, hashes, versions, tool outputs, and negative findings required for acceptance cannot be withheld merely because they are unfavorable.",
    "No clause transfers authority, licensing status, or ownership beyond the signed contract and governing law."
  ],
  "exclusions": [
    "no compliance certificate",
    "no silent inheritance of framework scope"
  ],
  "id": "WP-K06-04",
  "inputs": [
    "architecture findings",
    "facility profile",
    "source requirements",
    "license and contract scope"
  ],
  "k07Id": "WP-K07-04",
  "name": "Control tailoring and applicability determination",
  "negativeResultClauses": [
    "A failed, partial, stale, disputed, unavailable, or superseded result must be delivered and may not be converted into a pass.",
    "Discovery of a safety, authority, evidence, or common-cause defect triggers prompt notice and preserves stop authority.",
    "Acceptance of one deliverable does not waive latent defects, falsified evidence, or later-discovered nonconformance.",
    "The final package must distinguish work completed, work not performed, evidence unavailable, and owner decisions pending."
  ],
  "objective": "Select, modify, reject, or defer controls with explicit mapping quality, applicability evidence, and unresolved gaps.",
  "releaseId": "K12-2026-08-16",
  "slug": "control-tailoring",
  "statementOfWork": {
    "contractorDeliverables": [
      "tailored control baseline",
      "mapping-quality register",
      "not-applicable decisions",
      "conflict and supersession log",
      "implementation evidence plan"
    ],
    "dependencies": [
      "WP-K06-03"
    ],
    "exclusions": [
      "no compliance certificate",
      "no silent inheritance of framework scope"
    ],
    "governmentOrOwnerFurnishedInformation": [
      "applicable authority and contract scope",
      "facility pattern and site facts",
      "source requirements",
      "architecture findings",
      "risk and license conditions"
    ],
    "performanceOutcomes": [
      "site-specific control baseline",
      "applicability and mapping-quality decisions",
      "compensating-measure register",
      "implementation and evidence plan"
    ],
    "performanceStandards": [
      "Every control is exact, partial, informative, conflicting, superseded, not applicable or unresolved",
      "Mappings cite exact current source sections",
      "Control selection is not represented as compliance"
    ],
    "periodOfPerformance": "To be defined by the acquiring authority; no duration is inferred by the public pattern.",
    "purpose": "Select, modify, reject, or defer controls with explicit mapping quality, applicability evidence, and unresolved gaps.",
    "qualitySurveillance": [
      "mapping validation",
      "citation replay",
      "language audit"
    ]
  }
}