PROJECT 004 / LEARNING DEMO

An implemented control still needs evidence

REQ-007: MFA for in-scope human advertising-account logins. Three reproducible runs show the difference between tracking work and supporting an assessment claim.

Fictional sample. Assessment date held at October 28, 2026. The original data is preserved.

Results from the generated assessments, not a compliance score
RunREQ-007 resultSupported draftsNeed work
Original assessmentneeds work411
Action marked ready for reviewneeds work411
Evidence mapping addedsupported draft510

Follow the logic

  1. Before: REQ-007 maps to CTL-007. Its status is implemented, but evidence_ids is blank. The evaluator records a missing-evidence finding.
  2. Action ready: ACT-005 changes from planned to ready_for_review. The finding remains. Action status is planning information and is not an input to the assessment verdict.
  3. After: CTL-007 now links to EV-007. That existing synthetic record has a reference, reviewed status, and a review date within the configured freshness window. Other required metadata also passes, so REQ-007 becomes a supported draft.

Only REQ-007 changes assessment result. The other 14 requirement records are unchanged.

This is a mapping exercise, not an MFA implementation or verification. We did not configure MFA or inspect evidence. A human would still need to examine the actual policy, account coverage, exclusions, and relevant authentication behavior before endorsing the claim.

Explain it yourself

  1. Why does implemented status alone fail the first run?
  2. Why does marking an action ready not resolve the gap?
  3. What metadata does EV-007 provide, and what does it not prove?
  4. What should happen if that review is stale or rejected?

Inspect comparison data · Read the assessment logic · Read this exercise