This view keeps evidence pressure tied to the specific control family most likely to fail under buyer, investor, or partner review.
| Lane | Track | Gap headline | Evidence signal | Missing artifact | Coverage | Freshness (days) | Owner readiness |
|---|---|---|---|---|---|---|---|
| AI governance control family | AI_GOVERNANCE | AI governance is close, but still needs fresher operational proof. | Exception-routing and rollback evidence is older than the trust language implies. | Fresh operating exports for exception handling, evaluation review, and rollback outcomes | 70 | 26 | 72 |
| Identity and access control family | IDENTITY | Identity is the healthiest control family, with only minor freshness cleanup left. | Guest-review evidence is slightly older than ideal, but ownership is clear. | One refreshed guest-access evidence export | 84 | 17 | 86 |
| Platform security control family | PLATFORM_SECURITY | Platform security needs escalation because proof is still fragmented. | Backup readiness, release rollback, and hosted-validator evidence are still loosely linked. | One end-to-end packet linking hosting controls to release and recovery proof | 63 | 22 | 61 |
| Procurement and trust center control family | PROCUREMENT_TRUST | This binder is structurally strong and mainly needs ongoing hygiene. | Questionnaire reuse still benefits from a more explicit proof index. | Published proof-coverage index across the trust layer | 88 | 10 | 84 |
| Revenue and reporting control family | REVENUE_CONTROLS | Revenue should be framed as an emerging control family, not a closed binder. | Cross-surface evidence is thinner than the strength of the integrated-control narrative. | One end-to-end evidence packet connecting reporting, attribution, and release controls | 58 | 21 | 60 |
| Regulated systems control family | REGULATED_SYSTEMS | The regulated binder is real, but still needs clearer provenance to feel durable. | Evidence dates and repeatability notes are weaker than the current trust narrative. | Fresh provenance notes and one repeatable control-family packet | 67 | 33 | 64 |