# Proposed verification standard and review governance

QK-PILOT-0.1 • 15 October 2026 • PROPOSED — NOT AN ADOPTED QILAHK STANDARD

Purpose: define a small, testable assessment program before making public assurance claims. These are candidate requirements to implement and demonstrate, not descriptions of existing controls. No accreditation or external recognition is asserted.

## Scope and criteria

Each engagement records the customer, asset aliases and privately resolved identities, authorized purpose, controls, operating-system/build assumptions, time boundary, evidence sources, exclusions, decision owner and acceptance criteria. No organization-wide approval may be inferred from a device sample.

| ID | Criterion | Required evidence | Pass | Other outcomes |
|---|---|---|---|---|
| ID-01 | Evidence tied to scoped device | Device identifier mapping and collection record | Identifier resolves to authorized scoped device | Missing/ambiguous: insufficient evidence; mismatch: reject submission |
| EV-01 | Fresh observation | Collection and receipt timestamps with clock checks | Collected within 24 hours before review for this pilot | Outside window: stale; future timestamp: reject pending clock investigation |
| EV-02 | Evidence completeness | Required fields and collector/source version | Required values present with declared method | Missing values: insufficient evidence |
| EV-03 | Evidence integrity and provenance | Hash manifest, protected transport, source authentication and custody record | Hash checks pass and source/custody accepted by reviewer | Hash mismatch: reject; weak provenance: insufficient evidence |
| SB-01 | Secure Boot enabled | Supported OS/firmware observation bound to device | Observed enabled=true | false: fail; unsupported or unknown: not established |
| TPM-01 | TPM readiness | Device-bound TPM status | Observed ready=true | false: fail; absent/unknown: not established |
| ENC-01 | Agreed volumes encrypted | Volume inventory and encryption status | All in-scope volumes meet agreed encryption requirement | Partial/disabled: fail; incomplete inventory: insufficient evidence |

The 24-hour window is a proposed pilot threshold, not an industry requirement or existing QILAHK commitment. Customer requirements may call for another versioned window. These checks establish reported configuration only; they do not establish absence of compromise, hardware attestation strength or cryptographic root of trust unless separately tested.

## Decision rules

- Approve only when every mandatory criterion passes with acceptable provenance and an accountable review.
- Return for evidence when a mandatory criterion is unknown, stale or incomplete.
- Deny when a mandatory condition fails and no approved program exception applies.
- Suspend a previously approved credential when material uncertainty requires investigation; record scope and reason.
- Revoke when the governing requirements are no longer satisfied; preserve the prior history and publish the permitted status/reason.
- Expire automatically at the credential's stated end time. Renewal is a new review, not merely a payment.
- Record each decision's evidence references, criteria version, exceptions, reviewer, approver and timestamp. Payment cannot determine the result.

## Reviewer qualification and independence

Before assigning a reviewer, retain a competence record covering Windows posture interpretation, evidence provenance, this program's criteria, handling rules and practical sample-case assessment. Obtain a second qualified reviewer for initial program cases and disputed findings. Publish named biographies and verified credentials only after the people and claims have been confirmed.

Require a documented conflict declaration per engagement. Record remediation involvement, financial interests and reporting relationships. Separate commercial negotiation from technical adjudication. Where personnel overlap, disclose it and obtain an independent second review; do not describe the review as independent without evidence that the safeguard works. Review payment must not depend on approval.

## Corrections and appeals

Proposed operating targets: acknowledge a factual correction or appeal within 2 business days; complete an initial review within 10 business days of receiving complete evidence, or provide a revised date. These targets need staffing confirmation before publication.

Accept a case reference, challenged finding, reason and supporting evidence through an agreed secure channel. Assign a reviewer not responsible for the disputed decision. Preserve the original, adjudicate against the applicable criteria, record the reason, and issue a versioned correction or upheld decision. No silent rewriting of registry history. Security-sensitive details stay private; publish only the agreed lifecycle status and bounded explanation.

## Public verification and production prerequisites

Publish issuer identity, credential ID, scoped subject, assessed attributes, criteria version, observation/review/expiry dates and lifecycle status. Bind records to cryptographic signatures and an independently trusted issuer key. Verification must check the exact signed bytes, key authorization, scope, time validity, event order and the latest authoritative status. A valid signature alone is insufficient.

Production also requires protected signing keys, access control, key rotation/revocation, authoritative time, durable append-only history, availability monitoring and a status freshness policy. An offline bundle cannot prove that no newer revocation exists. The companion sandbox demonstration does not satisfy these production prerequisites.

Release gates: technical lead validates criteria on controlled fixtures; operations validates procedures and capacity; designated authority adopts a version; independent reviewer checks sample cases; published wording matches implemented behavior. Record actual names and dates at adoption.