“Compliant” is incomplete without the benchmark, control identity, version, evidence and time that produced the result. Control assurance needs precise coordinates so the conclusion can be reproduced and understood later.
01 · A pass needs coordinates
The status alone cannot reconstruct the decision.
A dashboard may show that an asset passed a control. A reviewer still needs to know which benchmark release was selected, which control text applied, which rule evaluated it, what evidence was observed and when the evaluation occurred. Without those details, the result is a label rather than proof.
A control result is only as durable as the versioned record behind it.
02 · Controls change
The same control name can produce a different obligation.
Benchmarks evolve. Guidance is clarified, automated checks are revised, parameters change and controls move between sections. Provider services and evidence APIs change as well. A current result cannot safely overwrite a historical one as if both were evaluated under the same rule.
Version isolation preserves meaning. It prevents results from different releases being silently combined and allows an organisation to understand why its status changed after adopting a newer benchmark.
03 · The evidence record
Keep rule, evidence and asset identity together.
Statepoint treats the benchmark version, control identity, rule version, asset identity, observed facts, evidence source, timestamps and evaluation result as one connected record. That connection matters when a finding is challenged, a rule is corrected or a benchmark is upgraded.
Benchmark, release, control ID and applicable parameters.
Observed facts, source, freshness and collection context.
Rule version, result, reason, owner and approved exception.
04 · The evaluation path
Statepoint evaluates a control inside an explicit scope.
The evaluation starts by resolving the resource and the benchmark selected for its provider, service and environment. Source evidence is normalised without losing the provider identifier or collection timestamp. A versioned evaluator applies the control parameters and records both the result and the reason that produced it.
A collection or evaluator failure remains an error state. It is not converted into a pass, and unavailable evidence is not treated as proof that the control condition is absent.
05 · Preserve exceptions
Accepted risk is not a pass.
An exception changes the organisation's response, not the observed condition. The original result should remain visible alongside the exception owner, rationale, approval, expiry and compensating controls. Suppression should never erase the evidence or improve the underlying control result.
Keep observed state, evaluation state and exception state distinct.
06 · Reassess deliberately
New evidence should create a new decision point.
After a change, Statepoint can reassess the current estate against the applicable control version and retain the earlier result. This gives teams a visible sequence from observation to action to verified outcome, without losing the rule and evidence that explained each stage.