Conformance Claim Example

Informative Appendix Example (non-normative)

This example shows how a platform operator might complete the Conformance Claim Template. The organization, platform, evidence identifiers, and dates are fictional. This example is intentionally partial: it illustrates one possible level of detail and traceability without implying that every operator must use the same wording, evidence structure, or publication format.

Use this example with the Conformance Claim Template, Conformance Claim Schema, Checklists, and Evidence Package Manifest.

Conformance Claim

Scope of Claim

This fictional claim covers the Example Autonomous Testing Platform when operated by ExampleCorp Security Services for customer-authorized web application and API testing engagements.

Included deployment modes:

• Vendor-hosted SaaS control plane
• Customer-approved cloud scanner workers
• L1 Assisted, L2 Supervised, and L3 Semi-Autonomous operation

Excluded from this claim:

• L4 Autonomous operation
• Customer self-hosted worker deployments
• Wireless, physical, social engineering, and destructive testing modules
• Any engagement without a machine-readable Rules of Engagement record

Foundation Model Disclosure (APTS-TP-021)

ExampleCorp does not permit runtime model substitution outside the approved model allowlist. Emergency model changes require security review, audit logging, and customer notification when they affect active engagements.

Domain Summary

The table below is illustrative. A real claim can use the current requirement counts for the claimed APTS version and attach the completed checklist used during assessment.

Reminder: APTS requires 100% of requirements at the claimed tier to be met. Partial credit is not awarded.

Advisory Requirements (Optional)

Advisory practices are not counted toward the claimed tier. Clear labels for partial advisory implementation help customers distinguish advisory practices from tier-required controls.

Evidence Availability

ExampleCorp states that the following evidence is available to customers under NDA or through the customer trust portal:

• Completed APTS Tier 2 checklist with per-requirement status
• Sample Rules of Engagement validation report
• Kill switch demonstration recording from staging
• Sample audit log excerpt with sensitive values redacted
• Evidence package manifest for one representative finding
• Human review record for one critical finding
• Model version and capability baseline record
• Data retention and deletion procedure summary
• Independent internal review sign-off memo

Evidence package references:

Declared Scope Boundaries

ExampleCorp declares the following boundaries for this fictional claim:

• The platform does not support L4 Autonomous operation under this claim
• Customer-hosted workers are excluded because deployment hardening is customer-controlled
• Production testing requires explicit RoE authorization and Tier 2 safety controls
• Scanner workers cannot initiate lateral movement outside the approved target inventory
• Credential collection is disabled by default and requires customer-approved handling rules

These boundaries describe the claim's scope. They do not remove requirements that remain applicable to the claimed deployment.

Sample Requirement-Level Traceability

This abbreviated table shows one way to connect the high-level claim to requirement-level evidence. A real claim can replace these fictional evidence IDs with the operator's completed checklist outputs and evidence package references.

Example Customer Interpretation

A customer reviewing this claim should treat it as an operator-provided statement, not a certification. Reasonable follow-up steps include:

1. Compare the claim to the completed Checklists for the claimed tier
2. Request a small evidence pack using the Evidence Request Checklist
3. Review one representative Evidence Package Manifest
4. Ask for a vendor demonstration of behavioral controls such as kill switch and scope enforcement
5. Check whether the evidence shows that network actions were checked against the active RoE
6. Confirm that approval authorities, default-deny behavior, and escalation paths are documented
7. Verify that one reported finding can be traced from action to report with preserved evidence
8. Use Customer Acceptance Testing for higher-assurance deployments

Revision History

Disclaimer: This example is fictional and non-normative. It does not certify any real platform, create an APTS certification process, or modify APTS requirements. See the Introduction for the APTS verification model.