HOW TO INTERPRET EVIDENCE

Assurance methodology

Document availability, date semantics, claim attribution and independent certification are different questions.

Issuer and scope

A PDF or image on a website does not prove the issuing authority or the certified service boundary. Validate issuer identity, current status and holder from reliable source records.

Dates and relevance

An expiry date applies only where a valid certificate actually has one. An NIST alignment review and an IRAP assessment follow different review/assessment periods.

Confidence and uncertainty

Confidence should reflect independent verification, scope, evidence completeness and contradictions. A well-formatted illustrative document does not warrant high confidence by appearance alone.

Company attribution

GitLab and NSAA records are organised in distinct paths. Linking to a common library does not establish that one company's assurance applies to another.