Product · Evidence & Assessments
An assessment is only as good as what it was assessed against.
CertiField records not just the determination but the basis for it: the evidence behind it, the control it answers, the campaign it belonged to, and the exact architecture version the system was in when the assessment happened.
- Per-CCI results
- Review campaigns
- Assessment provenance
- Evidence packages
- Ref
- P-21
- Kind
- Evidence
- Binding
- evidence → control
- Storage
- scanned, hashed, versioned
Evidence that knows what it is evidence of.
Most programs have the evidence. What they do not have is a defensible answer to "which control does this support, and who decided that?" CertiField binds an artifact to the controls and assessments it supports at the moment it arrives, so relevance is recorded rather than reconstructed from a folder name eighteen months later.
Every upload goes through the same pipeline: extension and magic-byte validation against a minimal allowed list for that specific surface, malware scanning that fails closed, a SHA-256 recorded by the server rather than claimed by the client, and an audit entry for the accepted and the rejected alike.
- Bound to controls and to the assessments that rely on them
- Server-computed hashes, never the ones the uploader asserted
- Evidence packages assembled from what is already linked
- Continuity tracked so evidence going stale is visible before a review, not during one
- Ref
- P-22
- Kind
- Assess
- Scopes
- campaign · single control
- Granularity
- per CCI
Assess in campaigns, or assess one control.
A review campaign groups many control reviews into one assessment act, with impacts linked down to individual controls and CCIs. A single control can also be assessed directly, without a campaign, because that is how real remediation cycles work. Both are first-class, and both are recorded the same way.
Per-CCI test results, determinations, findings and the notes behind them stay attached to the control they belong to. Bulk attestation writes real state rather than logging an intention — a reviewer who attests eighty controls has changed eighty records, and the audit log says so.
- Ref
- P-23
- Kind
- Provenance
- Invariant
- publishing never re-binds
- Legacy
- reported as unknown
Every assessment is bound to what it was performed against.
This is the part that quietly breaks in most RMF tooling: the system moves on, and the assessment record silently starts describing a system that no longer exists.
CertiField records which published architecture version each assessment was performed against, and publishing a new version never moves that binding. Publishing is not an assessment act. Only a genuine re-assessment advances the binding, and only an audited, deliberate re-bind — with a rationale, and refused outright on a completed campaign — changes it by hand.
Assessments made before the binding existed are reported as unknown rather than back-filled with a guess, because the truth is that nobody recorded it. Staleness surfaces as an advisory, and an advisory never invalidates an assessment on its own.
What that buys you at a review
- You can say which assessments predate the change and which do not
- You can scope reassessment to the delta instead of the whole baseline
- An AO can see the basis for a determination, not just the determination
- Nobody has to argue from memory about when the diagram changed
- Ref
- P-24
- Kind
- Chain
The chain a reviewer can walk.
- EvidenceWhere did this come from?EV-4471 · sha256:9f3a…
- ControlHow is it implemented?SC-7 · Boundary Protection
- AssessmentWho assessed it, against what?CAMP-12 · architecture v7
- DeterminationWhat did they conclude?Satisfied
- FindingWhat requires action?F-0093 · CAT II
- POA&MHow is it being resolved?POAM-0093 · in progress
- SSP · SAR · PackageWhat did we hand the reviewer?generated from the above
From a generated sentence back to the evidence that supports it.
Next step