# Assess Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Gap analysis evaluates every in-scope control with current implementation status (met/partial/unmet) and supporting evidence"
- "Risk assessment assigns likelihood and impact scores to each gap using a consistent methodology"
- "Assessment documents the specific evidence reviewed for each control determination"

### Bad criteria — vague (no clear check)

- "Gaps are identified"
- "Risks are assessed"
- "Assessment is thorough"

