2. How to use this catalog
Establish the decision scope, bind the governing rules, and determine applicable profiles. Then assess controls in the dependency order defined by the Specification. Each card reproduces the immediate Prerequisites entry from Specification v1.13. The DACS Control Dependency Map v0.3 shows immediate and inherited dependencies and their required statuses; the Specification governs.
Pass required means the listed control has an evidence-backed Pass for the same applicable scope, relevant evidence, and effective versions. Recorded result required means its evidence-backed Pass, Fail, or Not Applicable with reason and supporting records are available. A recorded Fail can support a handling or recording test; it does not grant permission for use or satisfy a separate Pass requirement.
The lists retain the nearest necessary prerequisites. They omit earlier controls only where a retained path guarantees the required status and evidence. Independent branches remain listed. A control number does not establish dependency coverage. Resolve conditional dependencies through the recorded Applicability Rule; Not Applicable is not Pass and does not automatically remove another requirement.
Evaluate a control when its required evidence exists or its declared completion deadline expires. Required execution or persistence follow-up evaluations remain separate from controls already assessed before action. An incomplete evaluation is not Pass, Not Applicable, or a fourth control result. Do not claim full decision-scope conformance before every mandatory evaluation is complete. Section 9.1 governs Buffered Gate Capture; complete authorization and capture precede action even when durable persistence is delayed.
| # | Action | Evidence outcome |
|---|---|---|
| 1 | Determine applicability | Use the recorded Applicability Rule and scope facts. Record Not Applicable only when the rule evaluates false, with reason and supporting evidence. Unresolved applicability is Fail. |
| 2 | Inspect evidence | Retrieve required evidence for the scope and effective versions being assessed. Inspect attribution, authority, integrity, and timing where required. |
| 3 | Evaluate | Compare the evidence to the Requirement, Pass condition, Fail condition, authority, rule, threshold, version, or other control criterion. |
| 4 | Record result | Record Pass, Fail, or Not Applicable. Do not use a readiness state as a substitute for the control result. |
| 5 | Classify the failure | Identify whether the problem is missing evidence, ambiguity, missing authority, conflict, threshold failure, drift/change, unsupported discovery, prohibition, or missing execution record. |
| 6 | Remediate or disposition | Correct the failed condition through governed evidence or a repeatable mechanism. Apply the actual Gate disposition under recorded authority while correction remains incomplete. |
| 7 | Retest | Assess the corrected condition under its recorded effective versions. Preserve original evidence and results; create a new linked retest event. |
| 8 | Update Gate and conformance evidence | Create linked new Gate and Conformance Records where reassessment is required. Preserve historical determinations and verify any new permission for use. |
Universal card rules. The applicability, evidence-recording, result-recording, remediation, disposition, execution, and closure rules in Sections 2 through 5 apply to every control card. The cards intentionally repeat only control-specific instructions.
Evidence sufficiency baseline. Retrieve the required evidence for the stated scope and the version or effective state being assessed. Check its authority and integrity where required. An artifact’s existence does not establish that its control criteria are met. The Specification requirement, Prerequisites, Evidence to inspect, and Pass/Fail text are reproduced from v1.13. Other card fields are informative guidance; they do not add requirements or replace the global rules. Examples illustrate a point and are not complete evidence packages.