Choose the highest option you can fully substantiate for each question:
- A = 0: absent or unknown.
- B = 1: recognised, but incomplete or dependent on assertions.
- C = 2: documented and sufficiently developed for structured evaluation.
- D = 3: supported by the additional verification described in that answer.
D includes the applicable controls in C. If evidence is missing, choose the lower answer. Do not award points for a supplier’s roadmap.
Keep a simple evidence register: question → answer → evidence reference → reviewer → date → missing action. Label business-case inputs as provided, extracted, assumed or unknown.
There is no automatic “not applicable = 3” option. For a genuinely excluded capability, document the exclusion and verify that the deployed configuration enforces it. For example, a read-only information agent should demonstrate that it cannot change appointments.