An identity export reports MFA for 24 accounts. A local emergency account sits outside that export. Until someone verifies factor enforcement for that access path, the system may contain a way around MFA. That is a cybersecurity gap, not a paperwork defect.
The Blueprint defines CMMC 20X. This appendix shows how one security claim can remain connected to its sources, conflicts, software analysis, and human judgment.
The software preserves each layer instead of turning a machine output into a decision. Follow the claim from assertion to authority.
Multifactor authentication is enforced for synthetic privileged and network access paths in scope.
Multifactor authentication is enforced for synthetic privileged and network access paths in scope.
24 of 24 accounts visible to the identity provider are covered. The export cannot see local emergency accounts.
The identity-provider export reports complete coverage for its visible population while the exception register identifies a local emergency-account path outside that export. Collect source evidence for local emergency-account factor enforcement or narrow and re-review the claim.
The rule-based check returns pass with limitation. The AI analysis says: The structured export supports factor coverage for observed paths; the local emergency-account conflict requires human examination.
return for additional evidence: The local emergency-account path is inside the stated boundary but not covered by evidence of factor enforcement.
not issued. Legal or program effect: none.
The validator can confirm required fields, references, dates, and file integrity. Those checks make the record testable; they do not establish that the emergency account requires a second factor. Evidence sufficiency, CMMC findings, and decisions remain with qualified people and authorized organizations.
Inspect the record structure, validate an implementation, or map it to OSCAL. These discussion-draft files use synthetic data and carry no assessment or program effect.
Discussion draft v0.1 · synthetic · schema-valid · 9 KB
Draft 2020-12 · 13 KB
Non-normative mapping to OSCAL 1.2.3 · 4 KB