Risks to the achievement of objectives are identified and analyzed

What an auditor asks for

An assessor reads the risk register and checks that listed risks name what could go wrong, how likely it is, and the effect on the stated objectives.

• Risk register
• Risk analysis notes

Evidence ShipReady collects for CC3.2

ShipReady maps CC3.2 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database postureprogram-governance

Common gaps

• No artifact has been collected yet — ShipReady records the CC3.2 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.