Security and availability commitments are published where customers and partners can review them

What an auditor asks for

An assessor opens the published commitments and checks that a customer or partner can reach the same text without an internal account.

• Public commitments page
• Customer security summary

Evidence ShipReady collects for CC2.3

ShipReady maps CC2.3 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Configuration exportpublic-transparency

Common gaps

• No artifact has been collected yet — ShipReady records the CC2.3 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC2.1 — Control decisions are based on documented, current information about the system and its data