Assurance / containment

Which security claims hold — with proof — and whether a control actually cuts the attack path.

Family facts

Code: FAM-ASSURANCE
Status: ready — code maturity
Availability: available — whether it is offerable
Ingest: pull — how a target enters
Rules of Engagement: Not required
Kind: Family (a selectable assessment)

What it decides

Whether a stated security claim is actually backed by a verifier, and whether a control genuinely breaks the attack path.

How it works

It evaluates declared security claims and reports only on those a verifier actually checked, and tests whether a named control cuts a demonstrated attack path.

A claim that was not checked is never reported as secure — “not checked” and “secure” are kept strictly distinct.

Declared limits

Note

Assurance only asserts about claims a verifier actually checked; the absence of a check is not evidence of safety.

References

[1]OWASP SAMM / assurance cases

References point to public, well-known technical sources for further study.

Cryptographic seal

ready · available

GDPR / EU AI Act

ready · available

LGPD (Latam)

partial · partial

Attack chains & adversarial validation

partial · partial

How the catalog works

Families, states and the honesty guard.