Mapping Security Requirements to Product Controls and Operating Evidence

Summary

• - For each requirement, record the applicable document and version, scope, responsible person, implementation location, test method and actual evidence.
• - IRON MIND's local accounts, roles, artifact versions, QA and approval records, audit and recovery tools can be mapped to the organization's operating procedures.
• - SSO, external malware scanning and SCM are optional. Planned CDS Guard integration must not be recorded as a completed device-transfer test.
• - Revised October 6, 2026. Historical control counts and self-assessment scores are not evidence of current compliance. External certification and customer acceptance remain separate determinations.