WEBVTT

00:00:00.400 --> 00:00:04.173
This lesson follows evidence into findings and reports.

00:00:04.453 --> 00:00:05.324
Step one.

00:00:05.604 --> 00:00:09.122
Open Evidence and download the synthetic fixture JSON.

00:00:09.402 --> 00:00:12.815
Native vendor exports are not supported collectors.

00:00:13.095 --> 00:00:21.605
The current import contract accepts CAS metadata JSON or CSV, and one public certificate in a private
installation.

00:00:22.733 --> 00:00:23.627
Step two.

00:00:23.907 --> 00:00:25.509
Select Import evidence.

00:00:25.789 --> 00:00:34.392
Choose the synthetic JSON file and set the assessment date to October ninth, twenty twenty-six for this practice
fixture.

00:00:34.672 --> 00:00:38.527
Current customer reviews should use their actual assessment date.

00:00:38.807 --> 00:00:44.484
Never include private keys, credentials, card data or recovery shares.

00:00:45.600 --> 00:00:46.494
Step three.

00:00:46.774 --> 00:00:47.935
Select Import.

00:00:48.215 --> 00:00:53.149
The new snapshot contains normalized inventory and versioned rule results.

00:00:53.429 --> 00:00:57.040
Uploaded verified claims are downgraded to self-reported.

00:00:57.320 --> 00:01:01.720
Missing, stale or conflicting evidence cannot silently pass.

00:01:02.000 --> 00:01:05.913
A rejected file is not retained as accepted evidence.

00:01:07.000 --> 00:01:07.882
Step four.

00:01:08.162 --> 00:01:10.519
Open Findings and click a result.

00:01:10.799 --> 00:01:18.160
Read the outcome, severity, rule identifier, rule version, source digest and evidence pointer.

00:01:18.440 --> 00:01:23.525
Unknown and manual review require attention; they are not passing assessments.

00:01:24.667 --> 00:01:25.654
Step five.

00:01:25.934 --> 00:01:29.208
Open Policies and select Load policies.

00:01:29.488 --> 00:01:35.839
Review applicability, required evidence, remediation and source publication status.

00:01:36.119 --> 00:01:38.777
These are internal assurance controls.

00:01:39.057 --> 00:01:46.128
Algorithm recognition does not establish module validation, regulatory compliance or end-to-end readiness.

00:01:47.267 --> 00:01:48.324
Step six.

00:01:48.604 --> 00:01:50.043
Return to Overview.

00:01:50.323 --> 00:01:55.675
Choose Report Markdown, JSON or CSV for the intended reviewer.

00:01:55.955 --> 00:02:04.535
Download the CBOM only as the CAS-owned schema; it is not validated CycloneDX or SPDX interoperability.

00:02:04.815 --> 00:02:09.587
Preserve the assessment date, digest and rule versions with the report.

00:02:10.733 --> 00:02:11.650
Step seven.

00:02:11.930 --> 00:02:15.715
In Evidence, load the audit record and declared connectors.

00:02:15.995 --> 00:02:19.420
Check event history and each connector's limitations.

00:02:19.700 --> 00:02:26.167
Local audit chaining does not prove against whole-database rollback without an external trusted anchor.

00:02:26.447 --> 00:02:30.603
No vendor connection is initiated by viewing this catalog.