Changes to infrastructure and software follow a managed change process

What an auditor asks for

An assessor samples production changes and checks that each one was requested, reviewed, and released through the managed path.

• Change tickets
• Release record

Evidence ShipReady collects for CC8.1

ShipReady maps CC8.1 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database posturedb-posture
• Configuration exportsecurity-scan
• CI/CD and source controliac-scan
• CI/CD and source controlgithub-posture
• CI/CD and source controlbitbucket-posture

Common gaps

• No artifact has been collected yet — ShipReady records the CC8.1 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting record exists but was not reviewed in the current audit period, so the evidence has lapsed.