Control gaps found in evaluations are logged, assigned an owner, and tracked to closure

What an auditor asks for

An assessor samples gaps from evaluations and checks that each one has an owner and a recorded path to closure.

• Gap log
• Closure record

Evidence ShipReady collects for CC4.2

ShipReady maps CC4.2 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database postureprogram-governance

Common gaps

• No artifact has been collected yet — ShipReady records the CC4.2 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC4.1 — Control operation is checked on a schedule and the evaluation results are retained