ONE CONTINUOUS CHAIN OF PROOFBE → OPERATE → BECOME
01BE
REQUIREMENT
Know what must be demonstrated.
A scoped requirement starts the record. Choose a framework version, define applicability and connect your organization’s control.
ILLUSTRATIVE RECORD · 01PR.AA · Identity management & accessScope recorded · Mapping requires human review
02OPERATE
EVIDENCE
Give every claim a source.
Attach private evidence to the control. Preserve who uploaded it, when it was collected and which version supports the claim.
ILLUSTRATIVE RECORD · 02Privileged access review.pdfPrivate file · SHA-256 recorded · Review date retained
03OPERATE
VERIFICATION
Inspect the proof. Record the decision.
A person reviews coverage and context. Deterministic checks evaluate freshness, mappings and findings. AI suggestions do not establish readiness.
ILLUSTRATIVE RECORD · 03Control + evidence → explicit human reviewAccepted / rejected · Rationale · Reviewer · Timestamp
04OPERATE
GAP
Make the missing piece visible.
An open finding remains visible even when other evidence looks complete. Describe the issue, its severity and the requirement it affects.
ILLUSTRATIVE RECORD · 04Privileged-account review is incompleteOpen finding → readiness blocked
05OPERATE
REMEDIATION
Assign the work. Ask for proof.
Give the action an owner, a due date and an expected evidence outcome. Completing a task is not the same as resolving a finding.
ILLUSTRATIVE RECORD · 05Complete the account review and submit the recordProof submitted → separate review required
06BECOME
READINESS
Bring a record you can explain.
Trace each readiness state back to a scoped requirement, reviewed mapping and current evidence. Choose exactly what to release to your independent auditor.
ILLUSTRATIVE RECORD · 06Requirement → control → evidence → reviewExplicit release · Fixed manifest · Expiry & revocation
AI reasons. Deterministic checks prove.
No AI service is connected. Readiness comes from explicit records and review.
END OF PREPARATION · START OF INDEPENDENT ASSESSMENT
Prepared is not certified.
Your company→CertiBOB™Preparation & coordination→Independent auditorAssessment & certification decision
CertiBOB prepares and coordinates across frameworks, standards and regulatory programmes. It does not certify organizations, replace the independent auditor, issue an audit opinion or guarantee certification.
™by Pralka Tech™