Documentation, method, and where to ask. Listed only where it exists.

The four-step workflow, the separated decision dimensions, export behaviour and how reassessment is governed.

Where the control library comes from, how precedence is recorded, and what a registered source does and does not mean.

Tenant boundary, invitation-controlled membership, enterprise identity, the two authorization gates and the audit model.

Organization setup, roles and permissions, invitations, identity connections, and the audit and notification views available to administrators and auditors.

A run through scoping, profiling, decision recording, review and export against synthetic data, with your own solution types in mind.

How the asset group and subgroup link sets the authoritative initial scope, where conditional risk tiers apply, and the fixed order in which later overlays are allowed to act.

Every fact the profile records, and which review signal each fact can raise. Signals are prompts for a person, and the reference says so field by field.

Applicability, implementation, design and operating effectiveness, and the maturity scale from 0 Absent to 5 Optimizing, with the rule that keeps each of them from inheriting another.

How sources are registered, versioned, mapped, re-verified and bounded, including the review work that is still open rather than only the part that is finished.

The shortest honest version of all of the above, written for an evaluator who has fifteen minutes.

The public changelog begins with general availability, so it will describe availability rather than activity. Release information reaches customers through the workspace it affects.

When a newer internal baseline takes effect, every affected assessment raises an owned, dated decision inside the workspace with recorded rationale. A change that matters to your results arrives as an assigned action, not as a newsletter you have to read.

Release detail relevant to an activated workspace is shared with the organization administrators responsible for it.

The route for evaluation, pilot discussion, security review and procurement questions. Describe the scope you need to assess and who would be nominated as your first organization administrator.

For a pending invitation, a missing membership, the wrong account, a suspended membership, an expired session or an expired entitlement.

Assurance evidence, questionnaires and diligence are handled as part of the access request rather than through a separate inbox.

Existing members enter their organization workspace through the application. This explainer says what signing in settles, what it does not, and where authentication happens. The website never authenticates anyone and never creates a membership.