G06 · reusable assessment method · Translate test evidence into an understandable decision and remedy.
List planned, executed, blocked, excluded and untested checks with reasons. Use explicit denominators; never count a draft as executed or cancelled work as successful.
Output: control-matrix.csv
Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.
State the business risk, affected target, observed control failure, reproduction evidence, limits, confidence and practical impact. Separate potential consequences from those demonstrated.
Output: findings.csv
Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.
Prioritise recommendations by the evidenced exposure and business consequence. Describe the control change and a later verification criterion. Do not allocate implementation work, schedules or prices during Part 1.
Output: findings.csv
Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.
An independent reviewer checks that claims follow from the evidence and that personal data and secrets are minimised. The executive summary includes strengths and effective controls.
Output: report-outline.txt
Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.
Record the report version, delivery receipt, reviewer and client acknowledgement. Keep an accepted assessment separate from still-open remediation actions.
Output: report-outline.txt
Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.