Chapter 5 of 12

5. Controlled disposition guidance

Use the applicable Gate logic under its recorded authority to determine readiness. The states below follow Specification v1.13 Section 3.4. The disposition patterns support diagnosis; they do not independently grant permission for use.

ProceedAll controls applicable to the Gate are Pass; controls that do not apply are recorded Not Applicable with reason. No failed control is being overridden for use. Use is permitted only within the recorded scope and while the readiness validity condition remains true.
CautionOne or more conditions require explicit constraint, monitoring, remediation, or an approved constrained-use exception. Any failed control remains Fail. Use is permitted only within the recorded constraint, authority, and readiness validity condition. Caution never converts Fail into Pass.
StopA completed evaluation identifies a failed control, prohibition, missing authority, invalid context, contract violation, or other rule that prohibits stated use. Use is not permitted for the stated material decision scope.
QuarantinedCandidate evidence has not completed the required evaluation or is held pending review or remediation and is not ready for stated use. Evidence may be explored, reviewed, remediated, or routed through additional Gates but shall not be relied on for material decisions.

Critical distinction

A control testing containment, testing, recording, or enforcement may Pass while another control remains Fail. Stop or Quarantined is not an automatic Fail for that handling control. A repeatable unresolved outcome is not permission for use. Full decision-scope conformance requires all applicable mandatory controls to Pass or be Not Applicable with reason; a permitted Caution exception does not establish it.

5.1 Reusable disposition patterns.

Each card uses a Disposition reference label to point to one of the D-01 through D-06 patterns below. The sentence that follows the reference explains why that pattern applies to that specific control. The reference does not change the control result and does not replace the Gate logic in the DACS Specification.

D-01 Missing prerequisiteApply the status stated in the control’s Prerequisites entry. A missing required Pass prevents dependent Pass; a Recorded result requirement may be met by an evidence-backed Fail or Not Applicable with reason. Block material use unless the applicable Gate explicitly permits it under valid authority. Diagnosis and containment may continue.
D-02 Unresolved governed evidenceKeep unresolved evidence out of material reliance. Use the applicable Gate to establish Quarantined for held candidates or Stop where a completed finding prohibits use. Caution requires valid authority for the exact bounded use; it does not close the failed finding.
D-03 Ungoverned candidate evidenceHold candidate evidence as Quarantined until Gate evidence permits its stated use. Any authorized constrained use follows Caution and its valid exception bounds. Correct containment may satisfy a handling control without promoting the candidate or changing other failed results.
D-04 Change or reassessmentReassess affected active or prospective reliance when a material change or validity trigger requires it. Invalidate or suspend prior permission for new reliance as defined. Preserve historical determinations and create linked replacement evaluations.
D-05 Threshold, constraint, or conflictApply the Gate to the recorded failed threshold, ignored constraint, or unresolved conflict. Caution permits only a valid bounded exception granted by competent authority. An exception cannot invent legal or policy authority or convert the underlying failed result to Pass.
D-06 Determinacy or repeatabilityTest unchanged inputs, rules, thresholds where used, versions, and scope. Different outcomes under unchanged conditions Fail. The same governed unresolved or exception outcome may satisfy repeatability while material reliance remains withheld under the applicable Gate.

Back to document overview

DACS Strategic Insights

Direct, zero-fluff updates on DACS controls, defensibility practices, and framework releases.

By subscribing, you’re asking DataVaultAlliance to send you DACS controls, defensibility practices, and framework releases. You can unsubscribe at any time. See our Privacy Policy. This site is protected by reCAPTCHA and the Google Privacy Policy
and Terms of Service apply.

Access This DACS Document

Verify your email to access the document. No account or password is required. You may need to verify again if you change devices, use private browsing, or clear your cookies.

We will use your email to provide access to the requested document. Marketing communications are optional.