What you can do
- Record system scope, tolerable-risk criteria and references to your approved risk assessment.
- Retain zone risk references, target rationale and target approval state.
- Carry that context into the CRS and governed reports.
- Use your approved external method for scenario analysis, risk scoring and residual-risk acceptance. A full risk-matrix engine is not part of the current product.
Keep the record defensible
Targets, machine findings, human decisions and implementation evidence have different roles. ZeroGapOT retains their relationships and review context so that a reader can follow the basis of the result. Review approval is not a certification or an SL-A claim.