K07 · evidence-bundled critical-infrastructure assurance

Vulnerability, defect, and nonconformance state

Direct answer

Vulnerability, defect, and nonconformance state provides bounded component or provenance evidence and must be combined with authenticity, installed-state, vulnerability, custody, and recovery evidence.

Stable record: SCA-K07-008
Claim status: PROJECT TECHNICAL PROPOSAL
Last reviewed: 2026-08-16
Research cutoff: 2026-08-16
Source type: GOVERNED PROJECT KNOWLEDGE
Currentness: Current for release 2.1.0; external sources require periodic revalidation.
Correction state: No unresolved public correction recorded for this release.
Machine record: Static JSON record

Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.

Artifact class

Supply-chain record
Stable ID	`SCA-K07-008`
Artifact type	DEFECT-REGISTER

Required fields

affected item
finding identity
severity and consequence
exploitability or failure precondition
status
mitigation
verification
exception owner
expiry

Validation expectations

source evidence
affected-version match
closure replay
exception review
reopen trigger

Limitations

no scanner proves absence of defects
severity does not equal mission consequence
accepted risk is not corrected defect

Source relationships

Federal Acquisition Regulation Part 46 — Quality Assurance — Federal Acquisition Regulatory Council; FAC 2026 current text reviewed 2026-08-15; CURRENT FEDERAL ACQUISITION REGULATION. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.
NIST SP 800-161 Revision 1 Update 1 — Cybersecurity Supply Chain Risk Management Practices — National Institute of Standards and Technology; Revision 1 Update 1; FINAL. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.

Assurance boundary

Inventory, signature, attestation, supplier status, vulnerability status, and installed configuration remain separate evidence properties. This record does not certify a product or prove that a deployed asset matches its declared bill of materials.