{ "schema_version": "1.0", "lab_id": "WACK-CUTOFF-LAB-0001", "content_id": "WACK-CONTENT-0142", "name": "Assessment Cut-Off Laboratory", "purpose": "Practice classifying dated control facts before deciding what the assessment can support at a named cut-off.", "status": "derived-from-practitioner-reviewed-method", "source_digest": "sha256:051ff1844bb8f5b22f6c9004375c794901851c4d0f2dd651adf30a125b79550b", "authority_classification": ["PRACTITIONER_METHOD", "AI_ASSISTED"], "boundary": "These are fictional teaching records. The laboratory does not decide PCI DSS compliance, replace assessor judgment, or determine a compliance-accepting entity's response.", "dimensions": [ { "id": "current", "symbol": "W/", "label": "Current", "question": "What is implemented and observable at the cut-off?", "color": "teal" }, { "id": "historical", "symbol": "W/∞", "label": "Historical", "question": "What occurred across the required operating period?", "color": "purple" }, { "id": "corrective", "symbol": "W/✓", "label": "Corrective", "question": "What failure was repaired, and when did the repair become true?", "color": "orange" }, { "id": "future", "symbol": "W/…", "label": "Future", "question": "What remains promised, scheduled, or dependent on later evidence?", "color": "red" } ], "cases": [ { "id": "newly-implemented-control", "label": "Case 01", "title": "The control arrived three days before cut-off", "cutoff": "2026-09-30T17:00:00-07:00", "period": "2026-07-01 through 2026-09-30", "claim": "The fictional automated privileged-access review control was implemented and operating throughout the complete assessment period.", "facts": [ { "id": "NIC-01", "at": "2026-08-12", "title": "Approved implementation plan", "text": "The approved plan scheduled production deployment for September 27 and described the expected automated review behavior.", "dimension": "future", "can_support": "That accountable implementation work was planned with a target and expected behavior.", "cannot_support": "That the control was already implemented, operating, or effective during July or August." }, { "id": "NIC-02", "at": "2026-09-27", "title": "Production deployment record", "text": "The deployment record identifies the production job, approved change, release version, and successful completion state.", "dimension": "corrective", "can_support": "That the planned implementation reached production on September 27.", "cannot_support": "That the resulting control state covered the complete population or operated before deployment." }, { "id": "NIC-03", "at": "2026-09-28", "title": "First scheduled execution", "text": "One scheduled run produced a review population, accountable decision record, and no execution error.", "dimension": "historical", "can_support": "One observed post-deployment occurrence on September 28.", "cannot_support": "A complete quarter of performance or sustained operation across unobserved occurrences." }, { "id": "NIC-04", "at": "2026-09-30", "title": "Cut-off configuration observation", "text": "Inspection at the cut-off found the production schedule enabled for the complete named system population.", "dimension": "current", "can_support": "The identified production configuration and population observed at the cut-off.", "cannot_support": "Past performance, a future successful run, or effectiveness beyond the work performed." }, { "id": "NIC-05", "at": "2026-09-30", "title": "July and August evidence gap", "text": "No execution record exists for July or August because the automated control had not yet been deployed.", "dimension": "historical", "can_support": "The boundary of the available operating history and the absence of the claimed earlier occurrences.", "cannot_support": "A conclusion that the new control operated throughout the stated period." }, { "id": "NIC-06", "at": "2026-12-31", "title": "Promised operating runway", "text": "The owner expects a complete quarter of recurring evidence to exist by December 31.", "dimension": "future", "can_support": "A remediation and evidence-collection commitment with a future target.", "cannot_support": "The assessment conclusion at the September 30 cut-off." } ], "bounded_conclusion": "The record can support that the control was deployed, configured for the named production population, and executed once before the cut-off. It cannot support the broader claim that this control operated throughout July through September.", "open_remainder": "The earlier operating period remains unsupported by this control. Any alternate control claim would need its own subject, period, evidence, testing, and authority.", "reopen_trigger": "A failed scheduled run, population change, configuration change, contrary observation, or completion of a longer operating period." }, { "id": "missed-periodic-activity", "label": "Case 02", "title": "The late scan passed. The missed period still happened.", "cutoff": "2026-07-15T17:00:00-07:00", "period": "Fictional quarter ending 2026-06-30", "claim": "The fictional quarterly external vulnerability-scan occurrence was completed within its assigned period and the defined public population achieved the required result.", "facts": [ { "id": "MPA-01", "at": "2026-06-30", "title": "Occurrence due moment", "text": "The operating calendar shows the quarter ending with no completed scan occurrence recorded for the defined public population.", "dimension": "historical", "can_support": "That the expected occurrence was not recorded within the assigned period.", "cannot_support": "Why it was missed, whether later work corrected current exposure, or the final assessment result by itself." }, { "id": "MPA-02", "at": "2026-07-02", "title": "Miss detected", "text": "The control owner opened an exception record, preserved the missed period, and identified the accountable owner.", "dimension": "corrective", "can_support": "That the miss was detected, retained, and entered into corrective workflow.", "cannot_support": "That the June occurrence happened on time." }, { "id": "MPA-03", "at": "2026-07-06", "title": "Late scan completed", "text": "A later scan covered the then-current named public population and produced a passing result after required remediation.", "dimension": "corrective", "can_support": "The later scan, its then-current population, result, and completed corrective work.", "cannot_support": "A scan occurrence inside the quarter that ended June 30." }, { "id": "MPA-04", "at": "2026-07-06", "title": "Current public-population reconciliation", "text": "The asset, hostname, and address records reconcile to the population represented in the late scan record.", "dimension": "current", "can_support": "The completeness of the named population used for the July 6 activity, within the reconciliation performed.", "cannot_support": "That the same population existed unchanged throughout the missed quarter." }, { "id": "MPA-05", "at": "2026-07-15", "title": "Cut-off observation", "text": "At the cut-off, no open vulnerability from the July 6 scan remains in the retained remediation record.", "dimension": "current", "can_support": "The observed disposition of the July 6 scan results at the cut-off.", "cannot_support": "A replacement for the missing June occurrence or an automatic assessment conclusion." }, { "id": "MPA-06", "at": "2026-09-15", "title": "Next occurrence planned", "text": "The owner scheduled the next scan early and added a second-person calendar check.", "dimension": "future", "can_support": "A future operating commitment intended to reduce recurrence risk.", "cannot_support": "Execution of the future scan or repair of the historical timing record." } ], "bounded_conclusion": "The record can support the preserved miss, the July 6 corrective scan and population, the observed current disposition, and a future prevention plan. The later passing result does not create an on-time occurrence in the quarter ending June 30.", "open_remainder": "The final requirement conclusion and any compliance-program treatment remain separate, accountable decisions based on the complete facts and applicable authority.", "reopen_trigger": "A changed public population, newly discovered endpoint, contrary result, missed future occurrence, applicable guidance condition, or compliance-accepting-entity direction." } ], "workshop": { "duration": "25 minutes", "sequence": [ "Read only the claim, cut-off, and assessment period.", "Classify each dated fact independently as Current, Historical, Corrective, or Future.", "Write the narrowest conclusion the classified record can support.", "Reveal the model, compare boundaries, and name the unsupported remainder.", "Record one exact event that must reopen the conclusion." ], "debrief": [ "Which future statement was most tempting to treat as present evidence?", "Which current fact was most tempting to project backward across the period?", "What corrective work improved the current state without rewriting history?", "Which authority owns the remaining decision?" ] } }