Agree what matters. Test the protection. Review the answer.
We examine the parts of your controls that matter to your risks, showing what works, what remains untested, and what needs to improve.
01 · Élucider
Understand your programme, environment and obligations. Follow relevant threat and failure paths to identify the protection that matters.
02 · Éprouver
Identify the testable protections required in your environment. A protection may depend on several controls. Examine their operation and shared dependencies, including how failures are detected and corrected. Agree the examinations and deciding evidence. Effective alternative protection counts when its operation and dependencies are evidenced.
03 · Évaluer
Challenge both the completeness of the examination and its conclusions. Keep exceptions, unanswered questions and review holds visible.
04 · Éclairer
Deliver bounded findings, remaining gaps and useful next steps. Preserve scope, observation time, assessed period and evidence limits so the result can be understood and reassessed.
The central account closed.
The application needed its own check.
Three departures · archive-prod · June 2026
- Supported
- Central disablement in 10–15 minutes against a four-hour criterion.
- Exception
- One application withdrawal occurred after the deadline. The other two were supported within 25 minutes.
- Limit
- This does not establish an attacker or data theft. Missing access history remains unresolved.
Next: the application owner addresses the late withdrawal and supplies evidence for reassessment.
Retained corrected run, 15 September 2026. Scripted synthetic review; not independently professionally reviewed or issued. Named system and supplied records only.
Read scope, checks and retained identity
Period: 2026-06-01T00:00:00Z to 2026-07-01T00:00:00Z (exclusive end). Assessment run recorded at 2026-09-15T13:03:39.462236Z.
Scope: worker-17, worker-24, worker-33; archive-prod; Retained customer exports.
- Supplied system inventory bounds this unit; omitted enterprise systems are not examined.
- Fictional source authority is stipulated, not independently authenticated.
- Population · supported
Reconciled 3 unit departures against a separately originated roster. - LEAVE-17 central · supported
Central disablement took 15 minutes; criterion 4 hours. - LEAVE-17 archive · exception
An application withdrawal action on archive-prod occurred after the allowed deadline. - LEAVE-24 central · supported
Central disablement took 10 minutes; criterion 4 hours. - LEAVE-24 archive · supported
Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement. - LEAVE-33 central · supported
Central disablement took 12 minutes; criterion 4 hours. - LEAVE-33 archive · supported
Application account and sessions withdrawn on archive-prod within 25 minutes using the automated arrangement.
Run: risk-run-bd1b55121121. Review: release on hold. The correction history preserves the original; this exhibit shows only the corrected run.
Source identity (SHA-256): be615e5b60683ab42740970ec096eaebddfa753f550fdf443b20c0a3cda6951b.
Three different gaps. Three different next steps.
What the demonstration establishes.
- The local fictional prototype performs bounded account and session examinations. It retains evidence relationships, corrections, review holds and outputs. The example above is one retained corrected run, not a released customer assessment.
- The retained D2 example uses authored testable parts and fixed procedures. The newer local prototype supports bounded contextual planning and examination using supplied or separately reviewed context interpretations. This example does not demonstrate that newer implementation.
- Candidate orchestration and evaluation mechanics exist. Retained comparisons use synthetic configurations; they do not establish live AI accuracy, independent professional validation or measured customer value.
- The local prototype now retains assessment records, provides scoped access and derives stakeholder views from the same assessment. Verification uses synthetic cases. Live model quality, independently unseen customer cases, provider deployment and recipient acceptance remain unproven. The proposed offer is one completed assessment for audit readiness and security decisions, with accountable review.
Earlier login-route evidence walkthrough.
Can another login route bypass the protection the company expects? Follow the requirement, evidence, competing explanation and review status below. These records describe a configuration snapshot, not an observed compromise or protection throughout a period.
Open the recorded evidence and review status
| # | TItem | =Subcontrol tested | Result | Confidence | {}Deciding checks |
|---|---|---|---|---|---|
| 1 | R-DATAUnauthorized disclosure of customer case files · risk register · owner: security leader | selected | selected | rated critical | |
| 2 | D1“Can a phished password bypass the intended identity protection?” · threat | protection required | scenario | A.5.15 A.5.16 A.5.17 A.8.5 A.8.3 | |
| 3 | C-ID-01Ordinary workforce access to sensitive data systems must use central SSO with MFA. Emergency accounts need separate approval and restrictions. · claimed: SSO deployment complete | 5 subcontrols | claim | Effective application authentication · 8 records · complete snapshot | |
| 4 | A.5.15no login route to console-prod bypasses the approved central-access rule | Ordinary-access requirement | [-] broke | firm | 8 records · 1 check |
| 5 | A.5.16the listed emergency account on console-prod has a bound approval and monitored use at the snapshot | Emergency approval | [?] open | tentative | 1 records · 1 check |
| 6 | A.5.17the central route's configuration declares a second factor at the snapshot | Central route | [+] held | firm | 1 records · 1 check |
| 7 | A.8.5 · enforcementevery effective login route to console-prod requires a second factor the access rule accepts at the snapshot | Ordinary-access requirement ∧ Central route | [-] broke | firm | 8 records · 2 checks |
| 8 | A.8.3sensitive customer-case export is reachable only through a route the access rule protects | Conditional disclosure path | [-] broke | firm | 8 records · 1 check |
| 9 | challenge“Emergency route, or a second door? The active local account is not on the exception list, and no approval for it was delivered.” · filed by the sample builder | before release | [?] unresolved | 1 objection filed | |
| 10 | releasea named reviewer controls publication | release on hold | [!] release on hold | 0 reviews · no opinion issued |
Status and confidence, printed on every line.
A test result describes one part of a claim. Held means that part survived the test; it does not mean the whole control passed. A release hold is different: a reviewer has blocked publication. Confidence describes the strength and limits of the evidence.
Read the result and confidence definitions
The method, as a sheet you can check us against.
The proposed delivery commitments and the records used to check them. They describe the intended service, not proof that a customer engagement has been completed.
Read the full method specification
- standard
- ISO/IEC 27001:2022 · internal audit under clause 9.2 · threat-informed · SOC 2 audit readiness is a planned application of the same assessment method
- scope
- the whole ISMS: clauses 4 to 10 and Annex A by your Statement of Applicability, including not-applicable entries where a top risk lives · one annual cycle, aligned to your surveillance or recertification audit
- entries
- control-led: every applicable control enters at the claim step with a baseline procedure (coverage) · risk-led: top risks enter at the risk step and add scenarios, positions and payloads to the controls they depend on (depth)
- programme rationale
- importance from your risk assessment and scenarios, per 9.2.2 · never from column order
- unit of work
- the position: one testable assumption inside a claim · a result is issued per position, never per control
- procedure
- versioned and hashed: payload, assertion, expected observation, comparison cases, unknown handling, limits, authority · stored with the run
- run
- deterministic: same procedure version, population and period, same bytes · any change is a new revision, never an edit
- status
- [+] held · [-] broke · [?] open · [ ] not run, printed first
- confidence
- certain · firm · tentative, describing the evidence, not the control · printed beside every status
- what AI does
- proposes scenarios, positions, draft procedures, explanations and objections · never executes a test, changes a result or releases a conclusion
- who decides
- a named auditor, accountable and identified in the record · a second qualified auditor as reviewer, named before the engagement · need not be the founder
- challenge
- structured objections; a hold blocks release until evidence or accountable review resolves it · review can hold, narrow or annotate; it never turns broke into held
- release blockers
- an unsupported favourable conclusion · an unsupported adverse conclusion · a missed known material failure · missing evidence treated as a pass · any one blocks our release whatever your controls did
- access
- scoped, read-only, time-bounded, per claim and per stage · pulled by us or exported by your engineers · a reviewed, versioned decoder per source · no standing connection, no synchronised copy · the grant lapses at stage end
- report
- the clause 9.2 internal audit report: programme rationale, scope, nonconformities with confidence, observations, opportunities, explicit unknowns · feeds the 9.3 management review
- records
- an audit-evidence record per control: criteria, population, procedure, method hash, result, confidence, coverage, proposed ISO wording, the named auditor’s determination · filed into your programme
- verification
- one corrective-action verification under 10.2, in a run linked to the original finding · the original stays on the record
- handover
- workpapers, procedure and software versions, reconciled populations, permitted evidence access, exit and retention record, machine-readable records · your certification body reperforms what it wants and issues its own certificate
- remediation
- guidance states what protection the finding shows missing and what evidence would show it restored · your team designs and builds the fix · we do not audit a control we helped remediate in the same cycle
- not
- an audit firm · a certificate or attestation · a tool you operate · continuous monitoring · a hosted trust centre · a penetration test · an internal audit function under IIA standards · a favourable result
- the sample
- Alder Works is fictional · fixed procedure · no live model in the demo · shows the grammar, not a customer finding
The package it can reperform.
The proposed handover contains records prepared for external-auditor review. Your certification body decides what to inspect, reuse or reperform and makes its own certification decision. No external-auditor acceptance or easier audit is guaranteed.
Inspect the proposed handover contents
Make the agreed coverage visible.
Risk-led depth adds to agreed coverage. An untested requirement remains untested; an evidence gap never becomes a pass.
Explore coverage in the fictional control register
Not a certification audit; impartiality rules keep the two apart. Not an internal audit function under IIA standards. Not a consultancy that rewrites your SoA. Not a penetration test. No continuous monitoring, no hosted trust centre, no remediation done for you, and we do not internally audit a control we helped remediate in the same cycle. No standing access: records are pulled per claim under a time-bounded read grant, or exported by your engineers, and the grant lapses when the stage ends. No favourable result promised. The sample on this site is a fictional company with no live model; it shows the grammar, not a customer finding.