References.

Evidence and interpretation

Technical claims link to their supporting sources. Hypothetical examples and proposed operating approaches remain distinct from documented incidents and external requirements.

An incident establishes a particular failure path. It does not establish how often that path occurs elsewhere or the loss every organization should expect. Limitations that affect a conclusion remain beside it.

The capability profile and 90 day planning sequence are proposed aids for assessment and delivery. They are not universal maturity standards or regulatory requirements.

Review before implementation

The sources were checked on 21 September 2026. Product behavior can change, so implementation needs to be checked against current documentation.

Regulatory claims need an assessment of the requirements applicable to the particular entity and service. Detailed cryptographic recovery and supplier limitations also need their own assessment.

Corrections and proposed changes can be raised in the repository, together with supporting evidence. Live credentials do not belong in those records.