K07 · evidence-bundled critical-infrastructure assurance
Data provenance, quality, and usage rights
Direct answer
Data provenance, quality, and usage rights provides bounded component or provenance evidence and must be combined with authenticity, installed-state, vulnerability, custody, and recovery evidence.
Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.
Artifact class
| Stable ID | SCA-K07-005 |
|---|---|
| Artifact type | DATA-BOM |
Required fields
- dataset identity
- source and acquisition authority
- collection and processing dates
- transforms
- quality and representativeness limits
- access class
- usage and retention rights
- poisoning and contamination checks
Validation expectations
- lineage graph
- hash or immutable reference
- sampling review
- policy and license check
- drift comparison
Limitations
- provenance does not guarantee truth or representativeness
- lawfulness can be jurisdiction-specific
- unknown source material remains unavailable
Source relationships
- NIST SP 800-218A — Secure Software Development Practices for Generative AI and Dual-Use Foundation Models — National Institute of Standards and Technology; Final; FINAL. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.
- NIST IR 8356 — Security and Trust Considerations for Digital Twin Technology — National Institute of Standards and Technology; NIST IR 8356; FINAL. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.
Assurance boundary
Inventory, signature, attestation, supplier status, vulnerability status, and installed configuration remain separate evidence properties. This record does not certify a product or prove that a deployed asset matches its declared bill of materials.