What This Domain Tells You
Governance establishes what the available safeguards and operating configurations look like, then supports comparison. A first complete baseline can receive full marks for being recorded. That is not proof that every rule is well designed.
Before You Assess
Keep the relevant pipeline and workflow sources connected. Comparisons need a previous usable baseline. Recurrence checks need a previously verified fix and a comparable rule.
Checks In This Domain
Your results cover only the checks selected for the assessment and supported by its evidence.
| Check | What It Looks For |
|---|---|
| Safeguard Baselines And Changes | Record the available pipeline safeguard configuration as a baseline. Baseline completeness is scored; configuration changes require review and do not alone prove weakened protection. |
| Operating Configuration Baselines And Changes | Record workflow activation, enrollment and actions as a baseline. Baseline completeness is scored; changes remain visible for review and do not alone prove incorrect operations. |
| Verified Fixes Do Not Recur | Retest previously verified fixes under the same rule. A confirmed failure scores zero; no previous fixes means not applicable. |
How To Use The Findings
Review changes in context: some are intentional improvements. A change is not automatically a failure. Investigate a recurring confirmed issue to understand why the original correction did not hold.
Read The Outcome Correctly
A confirmed issue means a stated requirement was not met. A review indicator needs business context. Unavailable evidence or history means the outcome could not be established; it is not an automatic failure. Read coverage alongside any score.