UAIF / L4
Incident vs. Vulnerability
Static exposures vs. dynamic occurrences
Domain purpose
Static exposures vs. dynamic occurrences
Fields, modifiers, profiles and tests
L4-F01Record Type
Capture and validate the record type element within the Incident vs. Vulnerability layer.
L4-F02Linked Vulnerability Id
Capture and validate the linked vulnerability id element within the Incident vs. Vulnerability layer.
L4-F03Exposure Duration Hours
Capture and validate the exposure duration hours element within the Incident vs. Vulnerability layer.
Implementation use
Determine applicability using the framework scope and system context. Implementation should be proportionate to risk and supported by evidence sufficient to validate the intended outcome.
Practitioner and validation guidance
Distinguish an incident from a vulnerability or observation and link related records without collapsing their different evidentiary states.
- Validate the applicable profile and all conditional requirements.
- Retain source evidence, analyst rationale and transformation history.
- Record uncertainty and do not infer regulatory, certification or legal outcomes.