Primary and secondary credentials

What the clause says

A primary credential comes from a body with the recognised authority to issue or hold the attribute. A secondary credential is derived from one. Both need checks, and a secondary credential needs extra care for capture error and for the standing of its producer.

What it supplies to a comparison

The credential class sets the evidence a comparison should demand. A primary document needs an issuer and a forgery check; a derived record needs the derivation rule and the source behind it.

Evidence to keep

• The credential class for each input, with the issuer named.
• The derivation or verification step that produced any secondary credential.

What the evidence looks like

For 4.1.2, the first artefact is The credential class for each input, with the issuer named.. The second is The derivation or verification step that produced any secondary credential.. If 4.1.2 has no first artefact, the practice is unproven at 4.1.2, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Is the document or record primary, and who is the authoritative party?
2. What check would catch a genuine document issued to the wrong person?

How it connects to the draft

Primary and secondary credentials belongs to 4 characterisation, and it gives the analysis one fixed point: The credential class sets the evidence a comparison should demand. A primary document needs an issuer and a forgery check; a derived record needs the . A comparison that cannot place a result against 4.1.2 is measuring something the framework has not defined, and the report should say so.

In the register, 4.1.2 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.