The processing sub-system

What the clause says

The processing sub-system gathers components, guards against attacks, handles contra-indicators, combines sources, supports data rights, delivers the attribute, logs its activity and publishes the practice statement.

What it supplies to a comparison

This is where most comparison evidence lives: logs, delivery records, attack handling and the published statement. A comparison that only scores the component leaves this evidence unread.

Evidence to keep

• Sample logs showing a decision from input to delivery, with the timestamp.
• The data rights route, tested with a real request.

What the evidence looks like

For 4.1.3, the first artefact is Sample logs showing a decision from input to delivery, with the timestamp.. The second is The data rights route, tested with a real request.. If 4.1.3 has no first artefact, the practice is unproven at 4.1.3, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Can the system show how a single decision was reached?
2. Where is the published practice statement produced and versioned?

How it connects to the draft

The processing sub-system belongs to 4 characterisation, and it gives the analysis one fixed point: This is where most comparison evidence lives: logs, delivery records, attack handling and the published statement. A comparison that only scores the c. A comparison that cannot place a result against 4.1.3 is measuring something the framework has not defined, and the report should say so.

In the register, 4.1.3 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.