# Diamond Fulcrum five-part publication series

## Part 1  Your PCI artifacts can all be correct and still disagree

The inventory, diagram, provider packet, scan population, and evidence repository may each be accurate for a different version of the environment.

That is formation drift. The problem does not live inside one artifact. It lives in the relationships among the claims. Start with one payment capability and ask whether Scope, Applicability, Implementation and Responsibility, and Evidence all resolve to the same fact version.

**Reader question:** Which artifact in your program changes last?

**Canonical destination:** https://theclusterofwack.com/diamond-fulcrum

## Part 2  Facts belong at the fulcrum

A requirement response should not become your architecture source of truth.

Maintain the assets, services, data flows, identities, locations, providers, configurations, responsibilities, occurrences, and changes first. Then project the bounded scope, applicability, implementation, and evidence claims. When the fact changes, every dependent projection gets a reopening signal.

**Reader question:** Can you name the authoritative fact behind your most important scope exclusion?

**Canonical destination:** https://theclusterofwack.com/diamond-fulcrum

## Part 3  The provider moved the work, not the accountability question

A compliant TPSP can perform an activity without answering every customer responsibility question.

Name the exact service. Record the customer configuration. Separate provider, customer, and shared verbs. Preserve assurance limitations and retained customer work. If the AOC or responsibility matrix contradicts the service you use, reopen the claim instead of polishing the deferral language.

**Reader question:** Which provider verb remains ownerless in your current model?

**Canonical destination:** https://theclusterofwack.com/diamond-fulcrum

## Part 4  Evidence cannot lead a broken formation

More evidence does not repair stale scope or ambiguous responsibility.

Evidence supports a bounded claim about a subject, population, period, and procedure. A current screenshot does not prove operating history. A green dashboard does not prove completeness. When evidence contradicts the assertion, preserve the contradiction and stop the conclusion where support ends.

**Reader question:** Which evidence object gets reused for the most unrelated claims?

**Canonical destination:** https://theclusterofwack.com/diamond-fulcrum

## Part 5  The assessor tests the formation

The entity owns the aircraft.

The assessed entity owns its facts, scope representation, control operation, responsibility model, and evidence production. The assessor examines and tests whether those claims are supported. If the formation only exists while the assessor is asking questions, the assessment has become the compliance program.

**Reader question:** Would your formation keep flying if the assessor left tomorrow?

**Canonical destination:** https://theclusterofwack.com/diamond-fulcrum

## Authority boundary

The Diamond Fulcrum is Scott Norton's independent practitioner model. It is not PCI SSC terminology or U.S. Navy doctrine and does not imply affiliation with or endorsement by PCI SSC, the U.S. Navy, or the Blue Angels.