# Assessment Cut-Off Laboratory

Status: **Derived From Practitioner Reviewed Method**

Authority: **PRACTITIONER_METHOD / AI_ASSISTED**

> Practice classifying dated control facts before deciding what the assessment can support at a named cut-off.

## Authority boundary

These are fictional teaching records. The laboratory does not decide PCI DSS compliance, replace assessor judgment, or determine a compliance-accepting entity's response.

## Run the laboratory

1. Read only the claim, cut-off, and assessment period.
2. Classify each dated fact independently as Current, Historical, Corrective, or Future.
3. Write the narrowest conclusion the classified record can support.
4. Reveal the model, compare boundaries, and name the unsupported remainder.
5. Record one exact event that must reopen the conclusion.

## Case 01 — The control arrived three days before cut-off

**Assessment cut-off:** 2026-09-30T17:00:00-07:00

**Operating period:** 2026-07-01 through 2026-09-30

**Claim:** The fictional automated privileged-access review control was implemented and operating throughout the complete assessment period.

### Dated facts

- **NIC-01 · 2026-08-12 · Approved implementation plan** — The approved plan scheduled production deployment for September 27 and described the expected automated review behavior.
- **NIC-02 · 2026-09-27 · Production deployment record** — The deployment record identifies the production job, approved change, release version, and successful completion state.
- **NIC-03 · 2026-09-28 · First scheduled execution** — One scheduled run produced a review population, accountable decision record, and no execution error.
- **NIC-04 · 2026-09-30 · Cut-off configuration observation** — Inspection at the cut-off found the production schedule enabled for the complete named system population.
- **NIC-05 · 2026-09-30 · July and August evidence gap** — No execution record exists for July or August because the automated control had not yet been deployed.
- **NIC-06 · 2026-12-31 · Promised operating runway** — The owner expects a complete quarter of recurring evidence to exist by December 31.

### Working record

| Fact ID | Current / Historical / Corrective / Future | What can it support? | What can it not support? |
| --- | --- | --- | --- |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |

**Your bounded conclusion:**


**Unsupported remainder:**


**Reopen when:**

## Case 02 — The late scan passed. The missed period still happened.

**Assessment cut-off:** 2026-07-15T17:00:00-07:00

**Operating period:** Fictional quarter ending 2026-06-30

**Claim:** The fictional quarterly external vulnerability-scan occurrence was completed within its assigned period and the defined public population achieved the required result.

### Dated facts

- **MPA-01 · 2026-06-30 · Occurrence due moment** — The operating calendar shows the quarter ending with no completed scan occurrence recorded for the defined public population.
- **MPA-02 · 2026-07-02 · Miss detected** — The control owner opened an exception record, preserved the missed period, and identified the accountable owner.
- **MPA-03 · 2026-07-06 · Late scan completed** — A later scan covered the then-current named public population and produced a passing result after required remediation.
- **MPA-04 · 2026-07-06 · Current public-population reconciliation** — The asset, hostname, and address records reconcile to the population represented in the late scan record.
- **MPA-05 · 2026-07-15 · Cut-off observation** — At the cut-off, no open vulnerability from the July 6 scan remains in the retained remediation record.
- **MPA-06 · 2026-09-15 · Next occurrence planned** — The owner scheduled the next scan early and added a second-person calendar check.

### Working record

| Fact ID | Current / Historical / Corrective / Future | What can it support? | What can it not support? |
| --- | --- | --- | --- |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |

**Your bounded conclusion:**


**Unsupported remainder:**


**Reopen when:**


## Debrief

- Which future statement was most tempting to treat as present evidence?
- Which current fact was most tempting to project backward across the period?
- What corrective work improved the current state without rewriting history?
- Which authority owns the remaining decision?

---

_The Cluster of Wack is an independent practitioner resource and is not affiliated with or endorsed by PCI SSC._