Assessment Body QMS Integration Guide

1. Purpose

This guide helps assessment bodies document SWT3 witness evidence verification as a repeatable procedure within their quality management system. It applies to Notified Bodies (NBs) under the EU AI Act, CMMC C3PAOs, ISO 42001 certification bodies (CBs), bank examiners conducting SR 11-7 reviews, and any accredited assessment organization that encounters SWT3 evidence.

If your organization uses SWT3 evidence in conformity assessments, your QMS must document:

• How you verify anchor integrity (procedure steps)
• What competences your assessors need (personnel qualification)
• How you determine evidence sufficiency (acceptance criteria)
• How you handle discrepancies (exception procedures)
• How you retain verification records (record management)

Your national accreditation body (NAB) or NANDO auditor will expect to see this documentation during surveillance assessments. This guide provides a template you can adapt to your existing QMS structure.

2. Scope and Applicability

3. QMS Procedure Template

The following is a sample documented procedure. Adapt the structure, numbering, and format to match your existing QMS documentation conventions.

4. Personnel Competence Requirements

Assessors using SWT3 evidence must demonstrate the following competences. These can be incorporated into your existing competence matrix (ISO/IEC 17065 Clause 7.4 or ISO/IEC 17021-1 Clause 7.2).

5. Handling Discrepancies

When the assessor's independent findings differ from SWT3 verdicts, the assessor's determination takes precedence. SWT3 is evidence, not a determination. Document discrepancies as follows:

6. Responsibility and Liability

• Evidence evaluation: Determining whether SWT3 evidence is sufficient, appropriate, and relevant to the specific assessment context.
• Independent verification: Confirming anchor integrity through the verification steps documented in your QMS procedure (Section 3).
• Assessment determination: Making all conformity/non-conformity determinations based on the totality of evidence, including but not limited to SWT3 anchors.
• Report accuracy: Ensuring the assessment report accurately reflects the evidence reviewed and the findings documented.

SWT3 witness anchors are analogous to other technical evidence sources your assessment body already uses:

If an SWT3 anchor is later found to be incorrect (e.g., a PASS was issued for a control that was not actually operational), the assessment body's independent verification step (Section 3, Step 3) is the control that should have caught the discrepancy. This is consistent with how assessment bodies handle any third-party evidence source.

7. Record Retention

Retain all SWT3-related assessment records per your existing QMS retention policy. The following minimums are recommended:

8. Management Review

Include the SWT3 verification procedure in your annual management review cycle (ISO/IEC 17065 Clause 8.6 or ISO/IEC 17021-1 Clause 9.3). Review the following:

• Procedure effectiveness: Did the verification procedure produce reliable results? Were any discrepancies identified between SWT3 verdicts and assessor findings? If so, were the root causes understood?
• Protocol version changes: Has the SWT3 protocol specification been updated since the last review? If so, does the procedure need revision? (Major version changes to the fingerprint formula or anchor format would require procedure update.)
• Assessor feedback: Did assessors encounter friction using the audit portal or verification process? Are there competence gaps to address?
• Accreditation body feedback: Did the NAB raise any concerns about SWT3 evidence usage during surveillance assessments?

Document management review outcomes and any corrective actions in your QMS records.

9. Initial Validation (Recommended)

Before incorporating SWT3 evidence into live assessments, we recommend a parallel validation exercise:

1. Select one assessment engagement where the provider uses SWT3 evidence.
2. Conduct the assessment twice: once using SWT3 evidence as supplementary evidence (per this procedure), and once using only traditional methods (document review, interviews, testing).
3. Compare outcomes. The assessment determination should not change based on the presence or absence of SWT3 evidence. SWT3 should accelerate evidence collection, not alter conclusions.
4. Document the comparison in your QMS as validation evidence for the new procedure.

If the parallel assessment produces different outcomes, investigate before proceeding. Possible causes: SWT3 evidence covered scope that traditional methods missed (or vice versa), temporal differences in evidence collection, or misalignment between UCT procedures and assessment requirements.

10. Presenting SWT3 Usage to Your Accreditation Body

When your NAB or NANDO auditor reviews your QMS and encounters SWT3 evidence usage, they will likely ask:

11. Interoperability Evidence

A technical evidence standard must be independently reproducible. The SWT3 fingerprint formula is implemented in 7 independent SDK implementations across different languages and runtimes:

All implementations are verified against a shared test vector suite (13 fingerprint scenarios, 2 signing scenarios, 5 hash scenarios). Any implementation that passes the test vectors produces identical fingerprints for identical inputs. This means:

• A provider using the Python SDK and an assessor using the Rust SDK will compute the same fingerprint for the same evidence.
• An assessor can verify an anchor using any implementation, or by computing the SHA-256 hash directly using standard cryptographic tools (OpenSSL, sha256sum, Python hashlib).
• No single implementation is authoritative. The test vectors are the reference.

12. Temporal Scope Guidance

SWT3 produces continuous evidence. Assessment methodologies (ISO/IEC 17065, NIST 800-53A, CMMC) are built around point-in-time or periodic assessments. This section provides formal guidance on reconciling the two.

12.1 Defining the Assessment Window

Before beginning the assessment, define the assessment window in your assessment plan:

12.2 Evaluating Temporal Evidence

When reviewing SWT3 evidence within your assessment window:

• Continuous pass: A procedure with PASS anchors throughout the window provides stronger evidence than a single point-in-time test. Document this as "continuous conformity evidence over [N] days."
• Gap in coverage: If a procedure has no anchors for a period within the window (e.g., 10 days without evidence), note the gap. It may indicate a monitoring interruption, not a failure. Request explanation from the provider.
• FAIL followed by PASS: If a procedure shows FAIL early in the window and PASS later, document the timeline. The PASS evidence is valid only for the period after remediation. The FAIL evidence must be addressed in your findings (even if subsequently resolved).
• Evidence outside the window: Anchors minted before the window start or after the window end should not be cited as primary evidence. They may provide historical context but do not satisfy the assessment scope.

12.3 Citing Temporal Evidence in Reports

When citing SWT3 evidence in your assessment report, always include:

1. The assessment window (start and end dates) in the report header or methodology section.
2. The witness date of each cited anchor (convert the epoch timestamp to a human-readable date).
3. The total number of anchors reviewed within the window for each procedure.
4. Any gaps in coverage and the provider's explanation.

13. Anchor Citation Format for Assessment Reports

When citing SWT3 anchors in assessment reports, use the following format consistently:

For a complete worked example showing this citation format in context, see the Worked Assessment Report Example.