The following is a recommended buyer specification, not an assertion that every item is legally mandated. Use it to compare retaining, repairing or replacing the current platform.
| Requirement | Minimum acceptance evidence | Failure to reject |
|---|---|---|
| Authority and version | Original source, provision identifier, publication date, retrieved date and supersession relationship | A framework label without a source or version |
| Legal status | Separate values for applicable, future, proposed, guidance, professional standard, suspended and superseded | A proposal automatically generating mandatory overdue actions |
| Applicability | Entity, activity, data, geography, threshold, exemption rationale and approving owner | One sector-wide applicability switch |
| Date handling | Effective, compliance, coverage-period and submission dates stored separately | One due date used for every milestone |
| Change impact | Before/after comparison linked to affected policies, controls, assessments and open work | A content update overwriting approved mappings |
| Evidence provenance | Source system, collection time, period covered, reviewer and access classification | Successful collection presented as proof of control effectiveness |
| Exceptions | Rationale, approver, conditions, review date and closure evidence | Permanent exceptions without re-evaluation |
| Assurance separation | Distinct management assertions, auditor tests and conclusions | Shared editing that obscures who reached the conclusion |
| Portability | Bulk export of records, relationships, attachments, versions and approval history | A spreadsheet export that loses the audit trail |
Which scenarios should go into the GRC demonstration script?
Use synthetic data and require the same scenario from every shortlisted supplier:
- Changed law: replace a Colorado requirement while preserving the earlier applicability decision.
- Different dates: configure California’s audit coverage period separately from the report deadline.
- Suspended milestone: pause CMMC Phase II without removing applicable contract obligations.
- Restricted evidence: prevent a general control owner from accessing sensitive healthcare evidence reused by authorised assurance staff.
- Failed integration: show that stale asset or identity evidence triggers review rather than leaving an unexplained green status.
- Audit exclusion: document why one topical requirement does not apply to an engagement.
- Exit: export the entire scenario, including approvals and attachments, into a usable package.
Score what is demonstrated as standard capability, supported configuration, custom development or not demonstrated. Ask the buyer’s intended administrator—not just the supplier’s consultant—to perform one routine change.