01Start with the decision or control you need to understand
Begin here when you need to understand product and protocol terminology. Stay with the domain, relationship or service state named on the page; the task does not widen silently into a different security or product claim.
02Use the evidence boundary before interpreting a candidate or missing result
Shared or provider-managed infrastructure is dependency context and is not automatically customer exposure. Open the relevant report evidence when you need to verify the source, observation time, attribution or qualification behind it.
03Follow the exact owner, first step and closure evidence in the report
Complete the step shown on the page, then check the resulting state before moving on. Unknown, unavailable and not-applicable outcomes remain distinct, so absence is never presented as a successful or reassuring result.
04Repeat the assessment only when the resulting evidence will be comparable
Repeat the assessment only when the resulting evidence will be comparable. Record the resulting owner, evidence or recovery state where the product provides it, so another person can verify what happened without repeating the task.