Arcfield 9 · Performance evaluation audit

Source: Arcfield EN Companion · Volume 1 audit + OSCAL assessment plan (AP) / assessment results (AR) · oscal/assessment-plan.md, oscal/assessment-results.md · HITL: oscal-guide.md · SIMULATION

How this report is elaborated

Scope is the Volume 1 9 · Performance evaluation audit. Identities are the applicable ISO clauses or Annex A controls in this prefix. Process topics remain the operational evidence (foundation, certification, implementation).

The process we followed is ISO 27001 → Policies → Processes and Systems → Protected Assets → Objects needed by the process → Evidences. Standard vs policy examines whether a policy covers the cited clause or control. Policy vs evidence tests the join from policy rule to recorded evidence.

How to read this report

Start with Results at a glance, then how this category is set up. Glance is Conformity (share without an NC) plus Defined / Implemented / Effectiveness. An NC is recorded when there is no policy and no implementation evidence (Requirement ↔ evidence), when a measure is implemented without effectiveness evidence (Requirement ↔ evidence), or when the kernel join FAILs (Policy ↔ evidence, default minor). Standard vs policy stays HITL. Presence is not Defined = yes as a coverage PASS. UNKNOWN is not an NC.

Results at a glance

Conformity is the share of applicable identities without an NC. Companion Contract/Example unchanged. This is not a certification statement.

Nonconformities

Nonconformities this pack can show. Kernel FAIL is Policy ↔ evidence, default minor — not an automatic major. No policy and no implementation, or implementation without effectiveness evidence, is Requirement ↔ evidence. UNKNOWN is not an NC. Assessment Results stay the kernel SSOT. How to fix is the follow-up, not a customer ticket.

ISO 27001 norms and controls

Cited clauses and Annex A controls for this category. Defined is a cited policy (HOW). Standard vs policy stays HITL: Defined = yes does not score that the text covers the control. Implemented is in-pack or named operating evidence. Effective is the kernel join or HITL effectiveness. No policy and no implementation is an NC. Implementation without effectiveness evidence is an NC. Ratings are yes, no, or partially. DK or NA when this pack has no data.

What we found

What this pack actually cited for this clause or control identity. Counts are from this pack. Presence is not a PASS. No ISO shall-text.

9.1 Monitoring, measurement, analysis and evaluation

Quantitative

• Defined / Implemented / Effective = yes: 1/3 (DK/NA not counted as yes).
• Nonconformities (major/minor) on this identity: 1.
• Cited artefact IDs: 2.

Qualitative

Cited artefacts in this pack: IMPL-WB, MRART. Nonconformities recorded: 9.1 Monitoring, measurement, analysis and evaluation is named in this pack, but there is no effectiveness evidence. Cited implementation: IMPL-WB, MRART.. Other-book files stay on acquire pages. This chapter does not invent their content.

9.2 Internal audit

Quantitative

• Defined / Implemented / Effective = yes: 1/3 (DK/NA not counted as yes).
• Nonconformities (major/minor) on this identity: 1.
• Cited artefact IDs: 4.

Qualitative

Cited artefacts in this pack: IAP, CAR, MRMT, IAPC. Nonconformities recorded: 9.2 Internal audit is named in this pack, but there is no effectiveness evidence. Cited implementation: IAP, CAR, MRMT, IAPC.. Other-book files stay on acquire pages. This chapter does not invent their content.

9.3 Management review

Quantitative

• Defined / Implemented / Effective = yes: 1/3 (DK/NA not counted as yes).
• Nonconformities (major/minor) on this identity: 1.
• Cited artefact IDs: 2.

Qualitative

Cited artefacts in this pack: MRART, MRMT. Nonconformities recorded: 9.3 Management review is named in this pack, but there is no effectiveness evidence. Cited implementation: MRART, MRMT.. Other-book files stay on acquire pages. This chapter does not invent their content.

Tags in this report

Volume

Presence

Kind

Companion Contract/Example unchanged. This is the Arcfield simulation, not a customer pipeline. The factory simulator is not in this companion.