CYBRARY Unit 3 — Detections as evidence
10 minReading the checklist, gaps and all
Which requirements currently have graded detections standing behind them, and how to report the ones that do not.
By the end you can
- Read a zone checklist and separate evidence from gaps.
- Say what an assessor would accept as evidence for a requirement.
- Report a gap honestly rather than dressing it up.
What the checklist shows today
The checklist is generated from the detections the range actually grades. Where a requirement has none, it says so rather than claiming coverage.
| Zone | Evidence and gaps |
|---|---|
| Z-SAFETY — SL3 | Evidence on FR2, FR3, FR7. No gaps. |
| Z-CONTROL — SL3 | Evidence on FR1, FR2, FR3, FR6, FR7. No gaps. |
| Z-OPS — SL3 | Evidence on FR4, FR6. No graded detection yet for FR1. |
| Z-DMZ — SL3 | Evidence on FR5. No graded detection yet for FR1, FR6. |
| Z-ENTERPRISE — null | Evidence on none yet. No graded detection yet for FR1, FR5. |
What counts as evidence
A screenshot of a dashboard is not evidence. A detection that fires on a described behavior, with the records behind it, a time, an asset and a person who worked it, is. The point of tying alerts to requirements is that a plant can answer 'show me' without inventing anything.