K07 · evidence-bundled critical-infrastructure assurance
Procurement Acceptance Matrices
Direct answer
Every K07 work package exposes a measurable required result, assessment method, controlled outcome state, and negative-result handling rather than relying on vague completion language.
Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.
Acceptance criteria
| Package | Criterion | Required result | Assessment | Allowed outcome |
|---|---|---|---|---|
| WP-K07-01 | Authority completeness | Every action class has a named competent authority or an explicit UNAVAILABLE state | document review and owner attestation | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-01 | Scope precision | Assets, effects, locations, time window and exclusions are bounded | traceability replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-01 | Negative result preservation | Unresolved authority remains visible and blocks downstream readiness | graph propagation test | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-02 | HCE traceability | Every HCE maps to functions, pathways, controls and owners | cross-discipline review | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-02 | Consequence coverage | Physical, cyber, power, cooling and restoration consequences are represented | independent challenge | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-02 | No topology publication | Sensitive facility details remain access-controlled | artifact inspection | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-03 | Reproducibility | Every finding cites a versioned source artifact | finding replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-03 | Boundary coverage | IT, OT, power, cooling, physical, timing, model and recovery planes are assessed | coverage matrix | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-03 | No uncontrolled scanning | Fragile OT is not actively scanned without site approval | activity log review | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-04 | Applicability explicit | Every control is exact, partial, informative, conflicting, superseded, not applicable or unresolved | mapping validation | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-04 | Source precision | Mappings cite exact current source sections | citation replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-04 | No certification leap | Control selection is not represented as compliance | language audit | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-05 | Isolation | No production route, credential or uncontrolled effect path exists | independent network and artifact inspection | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-05 | Traceability | Every scenario maps to claims, controls and expected evidence | schema validation | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-05 | Reset | Known-good state and cleanup are demonstrated | repeatable reset exercise | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-06 | Provenance | Model, data, code and evaluation artifacts are versioned and linked | hash and lineage replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-06 | Bounded authority | Tool and actuator permissions are explicit and testable | policy enforcement test | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-06 | Failure behavior | Fallback and rollback operate under declared uncertainty | fault-injection exercise | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-07 | Measured restoration | RTO/RPO and safety objectives are directly observed | timed exercise | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-07 | Clean state | Recovered artifacts match approved hashes and compromise checks | independent verification | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-07 | Negative result | Missed objectives remain recorded and propagate | readiness graph test | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-08 | Completeness | Every mandatory dependency resolves or is visibly unavailable | graph validation | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-08 | Integrity | Every artifact has a digest and provenance record | manifest replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-08 | No suppression | Negative, disputed and superseded evidence remains accessible | independent audit | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-09 | Independence | Verifier has no delivery-team decision conflict | organizational review | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-09 | Replay | Selected claims and evidence can be independently reproduced | technical replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-09 | Disagreement preservation | Unresolved disputes remain in final record | record audit | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-10 | Owner confirmation | Observation does not begin before deployment confirmation | authorization check | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-10 | Exact comparison | Deployed artifacts and configuration are compared to approved manifest | hash and response replay | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
| WP-K07-10 | Operation boundary | Page availability is not treated as protected-system operation | evidence review | PASS, FAIL, PARTIAL, UNAVAILABLE, or NOT APPLICABLE with rationale |
Nonconformance rule
FAIL, PARTIAL, UNAVAILABLE, STALE, DISPUTED, SUPERSEDED, and NOT APPLICABLE results remain visible with rationale. Acceptance of a deliverable cannot rewrite a negative finding or waive falsified evidence, latent defects, or later-discovered nonconformance.