Control decisions are based on documented, current information about the system and its data

What an auditor asks for

An assessor selects a recent control decision and checks that the information it used was written down and still current at the time.

• System description
• Decision record

Evidence ShipReady collects for CC2.1

ShipReady maps CC2.1 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Policy documentconfluence-docs

Common gaps

• No artifact has been collected yet — ShipReady records the CC2.1 control as a gap until an evidence run produces one, never as an assumed pass.
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC2.3 — Security and availability commitments are published where customers and partners can review them