CertiField
Request a demo

Concept

The record is the artifact. The documents are what it emits.

An authorization record is the structured set of facts that constitute a system authorization. Everything a reviewer reads — the SSP, the SAR, the POA&M, the package — is a rendering of it.

  • One record per boundary
  • Documents are renderings
  • Regeneration is lossless
Ref
A-01
Kind
Definition

The definition.

An authorization record is the structured set of facts that constitute a system authorization: categorization, control baseline and tailoring, per-control implementation, architecture, evidence, assessment results, determinations, findings and POA&M items.

The claim inside that definition is the word facts. Not documents, not attachments, not a folder structure with a naming convention. Facts, with types and relationships, that can be queried, diffed, regenerated from and reasoned about.

Ref
A-02
Kind
Contents
Reference
SP 800-37 Rev 2

What is in it, and what each part renders into.

The parts of an authorization record, the facts each part holds, and the artifact section each renders into
Part The facts it holds Renders into
Categorization Information types, the confidentiality, integrity and availability impact of each, and the system impact level derived as the high-water mark across them. SSP — categorization section
Control selection The baseline that follows from the categorization, plus every tailoring decision and the rationale for it. SSP — control set
Implementation Per-control implementation status and the narrative statement, each tagged as authored, generated or accepted from a proposal. SSP — control implementation
Architecture The authorization boundary, trust zones, components, connections, data flows and interconnections, published as immutable content-hashed versions. SSP — boundary and diagrams
Evidence Artifacts bound to the controls and determinations they support, with the ingest source, the date and the false-positive decisions already made. SSP and SAR — evidence references
Assessment Per-CCI test results, the assessor, the method, the date and the architecture version each result was produced against. SAR — assessment results
Determination The satisfied or not-satisfied decision per control, who made it and on what basis. SAR — findings and determinations
Remediation Findings carried into POA&M items with scheduled completion, milestones and a link back to the finding that produced them. POA&M

Read the right-hand column and notice how much of an SSP is not prose. The categorization, the impact level, the control set, the implementation status, the boundary, the interconnections and the evidence references are all structured data that happens to be printed as sentences. Held as facts, those sections are deterministic — they regenerate identically and they cannot contradict the SAR produced the same afternoon.

Ref
A-03
Kind
Test

The test that separates a record from a document.

You cannot tell by looking at a demo. Both architectures produce a good-looking document in about ten minutes. Ask for one thing instead.

Change a fact. Regenerate the artifact. What was lost?

If the answer is "nothing", the document is a rendering. Regeneration is a routine operation because nothing in the document originated in the document.

If the answer is "the edits people made since last time", the document has quietly become the record. The structured data behind it is now a draft that nobody maintains, and the two will disagree within a month.

A tool that warns you not to regenerate has already told you which architecture it has.

The second test is provenance: point at a generated sentence and ask where it came from. A record answers with a fact and the evidence behind it. A generator answers with a template.

Ref
A-04
Kind
Provenance
Rule
no machine writes a fact

Every fact carries where it came from.

Once a record has been through import, generation and human editing, "who wrote this?" becomes a real question — and on most programs the honest answer is that nobody knows.

  1. Evidence
    Where did this come from?
    EV-4471 · sha256:9f3a…
  2. Control
    How is it implemented?
    SC-7 · Boundary Protection
  3. Assessment
    Who assessed it, against what?
    CAMP-12 · architecture v7
  4. Determination
    What did they conclude?
    Satisfied
  5. Finding
    What requires action?
    F-0093 · CAT II
  6. POA&M
    How is it being resolved?
    POAM-0093 · in progress
  7. SSP · SAR · Package
    What did we hand the reviewer?
    generated from the above

From a generated sentence back to the evidence that supports it.

Each statement keeps its tag: authored by a person, generated from the record, or accepted from a proposal on a date by a named user. If someone edits a generated statement, the tag changes to reflect that a human has taken ownership of the wording. An assessor asking which parts of the SSP a person actually stands behind is asking a reasonable question, and it should have an answer.

Ref
A-05
Kind
Consequence

Why this is the load-bearing idea.

  • Two formats cannot drift. The same record exports as OSCAL and as the DOCX a reviewer reads. One source, two renderings, no reconciliation.
  • Change becomes computable. You can diff facts. You cannot meaningfully diff a Word document into a reassessment scope.
  • Evidence stops being re-decided. A false positive judged once stays judged, because the judgment is a fact and not a memory.
  • Key-person risk drops. The reasoning is in the record rather than in the person who happened to make the call.
See the record behind the documents How artifacts are generated

Related: operational RMF, evidence-grounded generation, reassess the delta.

Next step

See what your RMF process looks like when the package keeps up with the system.

Request a demo Explore the product