Control operation is checked on a schedule and the evaluation results are retained

What an auditor asks for

An assessor checks that control checks ran on the stated schedule and that the results of those checks were kept.

• Control check schedule
• Evaluation results

Evidence ShipReady collects for CC4.1

ShipReady maps CC4.1 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database postureprogram-governance

Common gaps

• No artifact has been collected yet — ShipReady records the CC4.1 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC4.2 — Control gaps found in evaluations are logged, assigned an owner, and tracked to closure