Layer 1 — Knowledge
Knowledge Repository
CRI requirements, response guidance decompositions, evidence expectations, and the institution's control library
CRI v2.2 Source Material
Response Guidance
Evidence Packages
Control Library
Synonym Table
Layer 2 — Reasoning
Compatibility Reasoning
Systematic evaluation of each control against each requirement — selecting, assessing, and producing traceable verdicts
Control Selection
Capability Matching
Coverage Judgment
Gap Identification
Evidence Mapping
Layer 3 — Assessment
Quality Assurance
Every verdict is verified — quoted evidence checked against source, consistency validated, completeness confirmed
Quote Verification
Consistency Checks
Completeness Audit
Human Review
Layer 4 — Reporting
Assessment Workpaper
Structured deliverable with executive summary, per-requirement findings, evidence traceability, and remediation guidance
Coverage Scorecard
Findings Taxonomy
Evidence Matrix
Remediation Guidance
Audit Trail