Cited mapping versus analyst assessment

Cited mapping

A cited mapping is recorded only when a public page names the specific function, subcategory, clause, article or objective. The cell quotes that wording and links the page. If the page says “NIST AI RMF” or “ISO 42001 templates” and does not name a function or clause, there is no cited cell. Framework tags on a listing are not coverage cells.

Cited literature

A cited-literature cell is a third evidence type. It is not a vendor page and it is not an analyst assessment. We add it only when a peer-reviewed paper or official agency report explicitly applies the named tool to a named certification activity or framework — for example DO-178C, ACAS Xu verification, or assurance cases. Allowed sources are journal or conference papers, NASA NTRS reports, FAA or EASA reports, DTIC reports, and arXiv preprints that name their venue.

Each cell records:

• title;
• authors;
• venue;
• year;
• URL;
• an exact quote in which the paper states that application.

We do not add a paper that only describes the algorithm, cites the tool in related work without applying it, or names a certification activity without the tool. Public pages show the bibliographic title, venue and year. The quote stays on Pro.

Analyst assessment

An analyst assessment is our judgment that a documented capability supports a requirement the page does not name. Each cell has three parts:

• a quote from a cited vendor or official page that describes the capability;
• a one-sentence rationale that links that capability to the requirement;
• a confidence level of strong or partial.

Strong means the quoted capability is a direct measurement, test or control activity for that requirement. Partial means the capability is adjacent — for example a policy pack, inventory or monitoring feature that would typically be used as evidence for that function or clause. We prefer NIST function-level cells unless the capability is specific. We do not treat a CMMC or cybersecurity-only offering as DoD AI ethical-principles coverage. CMMC cells belong on the CMMC framework. DO-200B cells are for aeronautical data processes, not ML training sets. NIST SP 800-218A cells are for secure model-development practices, not CMMC levels.

An analyst assessment is never presented as a vendor claim. If the same tool and requirement already have a cited mapping, the cited cell stands and the analyst cell is omitted.

How to read the matrix

Public cells are counts: 2 cited, 1 literature, 3 analyst, or combinations such as 2 cited · 1 literature · 3 analyst. The Search status column says Cited mapping when any vendor cited cell exists, Cited literature when only literature cells exist, Analyst assessment when only analyst cells exist, and Searched, no clause when we looked and found neither a named clause nor an analyst cell yet. Requirement labels, quotes, rationales and confidence stay on Pro. See the coverage matrix.

Evidence strength badge

Each tool page shows an Evidence strength badge above the fold. It is computed from the same public counts as the coverage matrix. It does not read quotes, requirement labels or analyst rationales. Named-source mappings are vendor cited cells plus cited-literature papers.

• Strong — 3 or more named-source mappings (cited vendor pages plus cited-literature papers).
• Moderate — 1 or 2 named-source mappings.
• Emerging — 0 named-source mappings and at least one analyst assessment.
• None yet — searched, with neither a named-source cell nor an analyst cell.
• Unreviewed — not yet searched for clause-level mappings.

Cited mappings and cited-literature papers weigh more than analyst assessments because both are what a source names. Analyst cells are editorial and stay behind Pro. The badge is not a ranking, a certification outcome or a vendor claim. See the counts on the coverage matrix.