Inspect SCuBA, DISA, SLSA and C2M2 evidence

Before you begin

• Create/select a program for the relevant profile and confirm the Active client and Active program.
• Obtain the expected tenant, asset or builder identity independently of the supplied evidence file.
• These workflows inspect files locally. They do not connect to a tenant, execute DISA checks or automatically approve requirements.

1. Inspect SCuBA results

1. Select a CISA SCuBA — Microsoft 365 or CISA SCuBA — Google Workspace program. Open Run Assessment → Inspect external evidence.
2. Enter Expected tenant ID using the identity confirmed by the tenant owner. Do not merely copy an unexpected identity from the submitted file.
3. For Result / provenance file, choose the ScubaResults JSON exported by the supported tool: ScubaGear 1.8.0 or ScubaGoggles 1.0.0/1.0.1. A screenshot or arbitrary JSON export is not this format.
4. Click Inspect evidence. Review Rule / policy, Source result, Review state and Evidence / details. Missing policies remain missing; overrides and annotations require human review.
5. If the tool or policy version is rejected, retain the message and obtain a compatible export. Do not edit the version identifier solely to force acceptance.
6. Click Save evidence and workpapers, then Open saved report. Review the saved report before attaching it through Evidence. Use Compare previous result only with a compatible prior retained result for the same assessment context.

2. Inspect DISA assessment evidence

1. Select a DISA STIG / SRG assessments program and open Run Assessment → Inspect external evidence.
2. Enter Expected asset hostname / FQDN. Select an official XCCDF 1.2 Benchmark under Official XCCDF benchmark and a CKL XML or single XCCDF TestResult under Result / provenance file.
3. Enter the exact Profile ID when the result uses a profile. Leave it empty only for an unprofiled result. Independently confirm the benchmark release and target.
4. Click Inspect evidence. Read missing rules, manual checks, inherited/tailored scope and exceptions. The importer displays check/fix text; it never executes those instructions.
5. Use Save evidence and workpapers and Open saved report. Attach the reviewed output to the appropriate requirements. CKLB and generic SCC execution are not supported by this importer.

3. Inspect SLSA provenance

1. Select a SLSA program and open Run Assessment → Inspect external evidence.
2. Choose the in-toto Statement v1 / SLSA provenance v1 file under Result / provenance file. Choose the actual deliverable under Artifact to verify.
3. Enter Expected artifact subject name exactly as independently expected for that artifact and enter Expected trusted builder ID.
4. If performing the supported signature check, select an independently trusted RSA PEM public key under Trusted public key (optional, PEM RSA-PSS). This workflow supports DSSE RSA-PSS SHA-256; it does not provide general Sigstore/transparency-log verification.
5. Click Inspect evidence. Review the subject identity, builder identity, artifact SHA-256 and signature status. An unsigned result remains unverified.
6. Save the evidence/workpapers and open the report. A matching digest or supported signature does not by itself award a SLSA level; record your independent review before linking it.

4. Rate C2M2 practices

1. Select a C2M2 program. Open Run Assessment → Rate C2M2 practices.
2. Enter Business function / boundary and Reviewer. Confirm that the scope matches the program rather than automatically applying one rating across the whole organization.
3. For each practice, read its Action / evidence needed. Record the supported rating, owner and evidence/rationale. Keep practices Not assessed when the evidence is missing.
4. Set the intended domain target MIL values in the worksheet. Click Calculate domain maturity and inspect each domain’s result. MILs are cumulative; unassessed lower-level practices remain gaps.
5. Click Save worksheet to retain your work and Export maturity report to create the review output. Use Load worksheet to resume the compatible client/program worksheet later.

If something goes wrong