| Threat model | Maintainers | Per meaningful change | docs/security/threat-model.md |
| Abuse cases | Maintainers | Per meaningful change | docs/security/abuse-cases.md |
| Control applicability | Maintainers | Per release | docs/compliance/control-applicability.md |
| Control maps | Maintainers | Per release | control_maps/ and docs/compliance/control-maps |
| Risk register | Maintainers | Per release | docs/risk/risk-register.md |
| Security exceptions | Security owner | Per exception | docs/risk/security-exceptions.md |
| Accepted risk | Business owner / security reviewer | Per exception | docs/risk/accepted-risk-log.md |
| Completeness matrix | Maintainers | Per release | docs/completeness-matrix.md |
| Gate summary | sicario verify | Per run | generated/sicario/gate-summary.json |
| Scan coverage (per-rule coverage, caps/truncation counters, disabled rules, rule overrides, asset-root resolution) | sicario verify | Per run | generated/sicario/gate-summary.json (scan_coverage block) |
| Spec run evidence | sicario verify | Per run | generated/sicario/spec-run-evidence.json |