ME.17:5.1 - Separate Organizational-Selection Replay

The telecom SRA record is a different population, organizational System, and history and also enters through the candidate/observed-practice branch unless independent FPF Method admission is supplied. The value under test is the requirement that feature pre-study decisions include a performed security risk assessment. The selecting participant is the named telecom organizational System, the selected value is that requirement, and the receiving loci are its bounded feature-prestudy decisions during the reported period. Local compound predicate SRA-SelectionPredicate-1 is positive only when the current decision rule requires a named security-assessment Work result and the sampled feature decision actually designates such a result; the discriminating negative is a completed mandatory field with no recoverable assessment Work. A.6.RCD stops at this local claim, with no relation kind or occurrence identity admitted.

Distinguish the mandatory security-impact field, definition-of-done rule episteme, release checklist, SRA-forum Work and System, training Work, expert-help Work, stale source-description epistemes and templates, reorganizations, tool linkage, and appointed-guardian assignments. Candidate or source labels do not turn those materials into U.MethodDescription. None of these subjects alone establishes organizational selection or enactment.

Two hypotheses remain live. H-SRA-1 says mandatory fields, definition of done, and checklist are sufficient to select the practice for feature pre-studies; it predicts completed fields backed by actual assessment Work even without forum or expert intervention. H-SRA-2 says forum review, training, expert help, current descriptions, tool linkage, and guardian assignments are needed to turn nominal compliance into performed assessment; it predicts empty, copied, or unsupported fields where those conditions are absent. Later use and non-use in a 45-feature release, 41 respondent reports, forum use across eight projects, identified risks, requests for help, stale material, and reorganization effects supply positive and negative observations but do not isolate either hypothesis.

First return the supported organizational-selection account with its non-use and evidence limits. A named assessment Work result distinguishes actual assessment from nominal field completion; it does not establish that requiring another assessment is worthwhile for every feature. Appraise the disputed requirement through C.11.DUA: which security consequence it protects against, what the existing assessment basis covers, what a new assessment could change, and the burden, delay, and protective work it would displace. The reported presence of a forum, training, expert help, current material, tools, or guardians settles neither the merits nor authorization for a new rule.

For a constructed change with a new externally accessible function and an uncovered security consequence, suppose the specialist assessment is obtainable in the decision window and can change the protective design. Retain the assessment requirement for that scope and, if current records do not distinguish nominal compliance from performed assessment, select the bounded linkage to the actual Work result when its contribution warrants the cost. A record-linking proposal is not the assessment or evidence of its protective effect.

For the opposed constructed condition, suppose repeated low-consequence feature changes stay within an adequate existing assessment basis, and repeating the full assessment adds no useful distinction while displacing work on an uncovered exposure. Recommend a narrower requirement that reuses that basis and reopens assessment when the protected premise changes. A favourable merits judgement does not relax the rule: the binding requirement remains until its authorized revision or exception is available. If the current process provides no timely permissible route, return that impasse for the affected feature, not permission to bypass it.

Select any new support-condition comparison only when it can change the current decision and warrants its feasible work. The historical source does not supply the assignment, permission, or authority predicate for the proposed rule change; performing it stops at missing-change-authorization until that basis is recovered. The qualified historical account remains complete. Any causal conclusion about linkage, support, or protection requires C.28.

Preserve the gaps: not every engineer used the practice; some found it not worthwhile; several conditions covary; no universal transfer follows. Do not join this population, predicate, source-described practice, or consequence history to MeCaMinD.