Start with the baseline
Record expected behavior and its source: an agreed acceptance check, written scope, or another delivery record. Then record observed behavior and a way to reproduce it. Keep newly requested behavior separate; it may matter, but it is not evidence about the baseline.
CISA's Secure by Demand Guide supports asking suppliers for inspectable evidence. It does not define a defect, contract remedy, price, or delivery deadline.
Keep decisions explicit
The evidence packet's buyer worksheet captures acceptance conditions, ambiguity, decision owners, and any proposed commercial effect. An unresolved entry remains unknown.
| Record | Buyer evidence / decision |
|---|---|
| Expected behavior and source | |
| Observed behavior and reproduction | |
| Accepted condition or test | |
| Newly requested behavior | |
| Buyer and supplier decision owners | |
| Proposed cost or schedule effect | |
| Next evidence or escalation step |
This is not legal advice. Stop for appropriate commercial or legal guidance when the baseline, evidence, or decision owner is unavailable.
- Expected and observed behavior are separately recorded.
- A new request is not substituted for the original baseline.
- Cost or timing statements are marked proposed, not settled.
- Each open item has an evidence or escalation next step.