Detect change without rewriting the past
A route to investigation
A signal has an owner, context and next action instead of becoming an unexplained alert.
An explainable operating decision
Human reviewers decide whether to continue, constrain, remediate or reassess.
Preserved assessment history
Historical evidence and Scorecards remain unchanged. New decisions reference the earlier record.
Five families of drift
| Family | What can change | Review question |
|---|---|---|
| Configuration drift | Prompts, settings, tools, permissions or connectors. | Does operation still match the assessed version? |
| Behavioural drift | Actions, refusals, escalation or outcomes. | Is the difference meaningful for an approved criterion? |
| Input and population drift | Users, languages, documents or tasks. | Is the evaluated population still representative? |
| Operational drift | Dependencies, failures or workflow conditions. | Are operational issues changing control behaviour? |
| Governance drift | Policies, ownership, obligations or conditions. | Does the earlier decision retain a valid basis? |
A governed response to meaningful signals
Signal
Capture the observation, time and affected version. A signal is not automatically a failed assessment.
Triage
Check reliability, severity and whether the observation is new or already explained.
Investigation
Inspect relevant evidence, recent changes and potential consequences.
Human decision
An authorized owner records the response and rationale.
Remediation or reassessment
Correct an operational issue or prepare evaluation where the assurance basis changed.
Updated artifact where appropriate
Create a new record or update operational state without altering historical evidence.
Keep three records distinct
A restriction can be necessary while the historical assessment remains an accurate account of the earlier evaluation.
Historical assessment
What was evaluated, against which criteria, and what the reviewer concluded at that time.
Passport operational state
Current operating status and review conditions associated with the shareable record.
Publication state
Whether the Passport is published, withheld or withdrawn from its intended audience.
Agree what monitoring can observe
A monitoring plan names available signals, coverage gaps, collection boundaries and response owners. It distinguishes “unknown” from “healthy” when a signal is missing. Private environments require agreement on which information may leave the customer boundary.
No fixed monitoring latency is promised. Collection cadence and response expectations depend on the supported integration and engagement. Monitoring can prompt review; it does not automatically settle an assessment or legal question.
Prepare the review process
Identify change owners
Connect release, configuration and policy changes to the assurance owner.
Set escalation criteria
Define effects needing containment and those needing scheduled review.
Link supporting records
Keep the affected version, previous Scorecard and investigation evidence accessible to authorized reviewers.
Close the decision loop
Record remediation, reassessment scope and reasons for updated Passport state.
Questions about runtime monitoring and drift
Does every drift signal suspend a Passport?
No. Signals prompt triage and investigation. An authorized decision determines the appropriate response.
Should a historical Scorecard change after a new finding?
Preserve the historical record. New evidence and decisions reference it and explain whether a later assessment supersedes its use for current operation.