Not assessed
The requirement, applicability and current position have not been evaluated.
Next questionDoes this control apply, and what evidence is available?RACF-CC control assurance
Report progress without creating a compliance badge
A lightweight lifecycle model for showing whether controls have merely been identified, safely implemented, evidenced in operation or sustained over time.
Purpose
Describe the control—not the organisation
The assurance status applies to an individual control within a stated scope. It does not certify an organisation, prove compliance with another standard or support a general claim that the organisation is “RACF-CC compliant.”
Different controls will progress at different rates. The value is in showing that difference honestly, alongside evidence currency, exceptions and accountable residual-risk decisions.
Avoid the percentage trap
A single completion percentage can hide weak evidence, excluded systems and expired exceptions. Report lifecycle counts and important limitations instead of averaging unlike controls into one maturity number.
Seven lifecycle statuses
From uncertainty to sustained operation
Use the highest status supported by current evidence. “Piloted” may be skipped where a separate pilot would not be proportionate, but implementation and evidence should never be treated as the same claim.
Identified
A relevant control need, exposure or assurance gap has been confirmed.
Minimum recordScope, rationale, affected service and initial owner.Planned
The intended treatment, ownership, dependencies and success criteria are agreed.
Minimum recordApproved plan, target scope, evidence target and due date.Piloted
The control has been tested in a limited but representative scope.
Minimum recordPilot results, operational effects, exceptions and changes required.Implemented
The control is deployed to its approved scope with operational ownership.
Important limitDeployment alone does not prove coverage or effectiveness.Evidenced
Current evidence confirms intended coverage, technical operation and material limitations.
Minimum recordEvidence source, verification date, result, scope and reviewer.Sustained
Repeated evidence across the defined review cycle shows that the control remains operational.
Minimum recordReview history, current exceptions, trend and next assurance date.Evidence currency
“Sustained” requires another observation
RACF-CC does not prescribe one universal waiting period. The organisation should set a review frequency that reflects risk, volatility, service importance and the reliability of its monitoring.
A stable configuration might be reviewed periodically and after material change. A high-risk identity or detection control may need continuous monitoring plus formal periodic assurance.
Current
Evidence remains recent enough for the control’s risk and rate of change.
Repeatable
Another reviewer can understand how the result was obtained.
Scoped
The systems, users, services and exclusions represented by the evidence are clear.
Outcome-focused
The evidence demonstrates operation or effect—not only the presence of a setting.
Parallel governance record
Residual risk is not a lifecycle status
A control can be Evidenced or Sustained while still leaving residual exposure. Equally, accepting a risk does not make an unimplemented control mature.
Keep the control’s lifecycle status and the related risk decision as separate but linked records.
The deployed control operates across its approved scope, with documented exceptions.
Remaining exposure has rationale, safeguards, accountable approval and an expiry or review date.
Transparent reporting
Counts need context
State the control set, scope and reporting date before presenting lifecycle counts. Where counts are cumulative, say so explicitly so that readers understand that Evidenced and Sustained controls are included within the Implemented total.
Illustrative assurance statementDefined service scope • August 2026
Thirty-two controls had reached Implemented or later. Within that group, twenty-four had current evidence and seventeen met the organisation’s Sustained criteria. Six residual risks were subject to authorised, time-bound acceptance.
32Implemented or later
24Currently evidenced
17Demonstrably sustained
6Accepted residual risks
Illustrative figures only. The residual-risk count is reported separately and is not a subset or maturity tier.
Minimum control record
Keep enough information to defend the status
A lightweight tracker should make progress maintainable without turning assurance into paperwork.
- Control identifier and RACF-CC domain
- Applicable service and defined scope
- Accountable owner
- Current lifecycle status
- Evidence source and verification date
- Next review date or trigger
- Exceptions and compensating safeguards
- Linked residual risks and decisions
- Evidence confidence and limitations
Future downloadable tracker. The planned RACF-CC spreadsheet can implement these fields and reporting rules. The workbook should support the assurance model; it should not create a score, certificate or badge that the framework itself does not claim.
Voluntary support
Support Trends4You
Trends4You's practical guides, RACF-CC resources and downloadable tools are provided free of charge. If they've helped you or your organisation, you can support the time and hosting that keeps them freely available.
Support is entirely optional. Payment is handled on Stripe's secure site and does not provide additional access.
Connect assurance to action
Use evidence to start the next improvement cycle.
The RACF-CC method explains how current evidence informs understanding, prioritisation, implementation and the next assurance decision.