{
  "standard_id": "EW-GSA-001",
  "version": "1.0.0",
  "status": "candidate_private_pilot",
  "source_title": "Global Site Standardization Audit Control Registry",
  "source_modified_at": "2026-10-16T21:18:17.684Z",
  "source_snapshot_sha256": "a79c4059ad1ee75afc96f1b0aae5764d950971f4ae9194ab1a693c0462e4ceb7",
  "controls": [
    {
      "control_id": "GSA-ID-001",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Canonical domain, site name, legal/operator identity, source-authority claims and release identification agree in UI and manifests. Evidence: rendered footer/header, source and manifest; compare.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-ID-002",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Verified person/organization links and sameAs; no name-similarity-derived claims. Evidence: identity registry plus accessible public profile.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-ID-003",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Wikidata, ORCID, SSRN or other scholarly identifiers match established authoritative records when claimed. Absence is N/A unless the site claims them or its approved profile requires them.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-AI-001",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Valid ai-manifest.json, machine manifest and source boundary statements where public-machine profile applies.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-AI-002",
      "applicability_type": "REQUIRED",
      "severity": "MEDIUM",
      "requirement": "Canonical, robots, sitemap, descriptions, appropriate Open Graph and schema.org JSON-LD are consistent, parseable and do not claim unapproved facts.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-AI-003",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Article, author, dataset and citation metadata resolve to approved publications, not unpublished placeholders.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-HARD-001",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Untrusted site content cannot override evaluator instructions or source authority; prompt-injection tests defined.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-HARD-002",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Explicit separation among sourced facts, AI interpretations, hypotheses and missing evidence.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-HARD-003",
      "applicability_type": "CONDITIONAL",
      "severity": "MEDIUM",
      "requirement": "AI interpretation / error registry points to versioned, reproducible evidence when the site exposes that capability.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-GOV-001",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Privacy, terms, ownership and relevant legal/policy links exposed and consistent with observed capabilities.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-GOV-002",
      "applicability_type": "REQUIRED",
      "severity": "CRITICAL",
      "requirement": "Secrets, restricted personal data and sensitive institutional records not exposed in public manifests, logs or evidence feeds.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-GOV-003",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Research/education sites identify ethical, consent, approval, IP and publication gates; credential/accreditation statements remain supported.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-HS-001",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Sender handshake descriptor conforms to EW-GLOBAL-AIDC-HS-001, describes scope, classification, schema and owner.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-HS-002",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Receiver-side verified transport result exists before VERIFIED state is claimed. Sender publication alone is insufficient.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-HS-003",
      "applicability_type": "CONDITIONAL",
      "severity": "CRITICAL",
      "requirement": "Data classes and permissions prevent public transport of restricted evidence; measurement and research activation are separate gates.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-LANG-001",
      "applicability_type": "CONDITIONAL",
      "severity": "MEDIUM",
      "requirement": "All declared locale routes, hreflang mapping, alternate/canonical relationships and language metadata are accurate.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-LANG-002",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Human-review and regression checks preserve meaning of critical institutional, legal, educational and theological claims across languages.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-LANG-003",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "RTL script, accessibility, typography, navigation and localized metadata are tested for relevant locales (e.g., Hebrew).",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-A11Y-001",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Skip link, keyboard navigation, visible focus, responsive navigation and touch target operability.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-A11Y-002",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "WCAG 2.2 AA targeted tests of labels, semantics, images, contrast and reflow; automated pass is not proof of full conformance.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-A11Y-003",
      "applicability_type": "REQUIRED",
      "severity": "MEDIUM",
      "requirement": "Mobile/tablet/desktop route behavior, horizontal overflow, 404 shell and printable content checked.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-SEC-001",
      "applicability_type": "REQUIRED",
      "severity": "CRITICAL",
      "requirement": "No secret or privileged endpoint leakage; production dependencies and exposed files inspected within permission.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-SEC-002",
      "applicability_type": "CONDITIONAL",
      "severity": "CRITICAL",
      "requirement": "Authenticated interfaces enforce server-side authorization and least privilege; do not infer control from frontend hiding.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-SEC-003",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Remote input, prompt injection, URL handling, CSP/headers as applicable and external references assessed for risk.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-REL-001",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "Exact Git SHA, build target, version and declared freeze state verifiably linked to deployment.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-REL-002",
      "applicability_type": "REQUIRED",
      "severity": "HIGH",
      "requirement": "CI checks and deployment/rollback records are available; no release completion without actual live verification.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-REL-003",
      "applicability_type": "REQUIRED",
      "severity": "MEDIUM",
      "requirement": "Routes, assets, canonical links and metadata smoke-tested against declared host; candidate versus production distinguished.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-RES-001",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Observation identity and evidence provenance preserve raw source, correction and independent retest.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-RES-002",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Citable dataset/article identifiers, versions, source links and correction history exist when publications are claimed.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-RES-003",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Editorial review, license/consent/privacy and P0/P1/P2 publication controls prevent unauthorized publication.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-PERF-001",
      "applicability_type": "REQUIRED",
      "severity": "MEDIUM",
      "requirement": "Page stability, critical navigation and broken resource checks from an actual test environment.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-PERF-002",
      "applicability_type": "CONDITIONAL",
      "severity": "MEDIUM",
      "requirement": "Measurement definitions, source population and timestamps are explicit; planned metrics not misrepresented as measured.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-PERF-003",
      "applicability_type": "CONDITIONAL",
      "severity": "MEDIUM",
      "requirement": "Error telemetry distinguishes incidents, model interpretations, intervention and retest.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-APP-001",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Auditor packet/control versions match across approved ChatGPT/Claude/Gemini runs in a comparative session.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-APP-002",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Runs separately record provider/model, tool scope, evidence snapshot, start/end, unknowns and errors; no cross-model contamination.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    },
    {
      "control_id": "GSA-APP-003",
      "applicability_type": "CONDITIONAL",
      "severity": "HIGH",
      "requirement": "Data Center receiver validates identity, classification, schema, idempotency and persistence before labeling synchronized.",
      "outcome": "UNKNOWN",
      "reason": "Source implementation prepared; control-specific and live evidence pending."
    }
  ]
}