- Scope
- Evidence must identify what system, version, period and requirement it actually covers.
- Provenance
- Material public statements should remain traceable to an owner/source and review state.
- Privacy
- Public reporting must minimize or omit protected, personal and security-sensitive evidence.
- Freshness
- A prior valid result does not automatically describe a later version or operating state.
- Correction
- Supersession and correction should preserve history rather than silently overwrite it.
- Claim boundary
- Readiness for assessment, external assessment and certification are distinct events.