C5.7 Lifecycle and triggers

NIST SP 800-37 [20]; COSO principle 15 [2]; INFORM [7]; UNDRR [24]

The seventh component requires that every object the register holds, a system, a product, a model, a supplier, a contract, have a lifecycle state with continuous authorization while it operates and a disposal step when it ends; that substantial change, inside or outside, trigger a reassessment; and that early warning run on at least three cadences and, where physical hazards are in scope, on the four pillars of an end-to-end warning system. The lifecycle comes from the security risk management framework's seven steps, which treat the thing at risk as having a beginning and an end [20]; the change trigger is principle 15 of the governance framework [2]; the cadences are those of the composite index family, structural risk yearly, a crisis monthly, a warning months ahead [7]; the pillars, knowledge, monitoring, dissemination and response capability, are the disaster community's [24].

The component reconciles the register's habit of permanence with the fact that nothing in it is permanent. Every other source assesses risks as though their objects would always exist; the lifecycle says each has a state, a trigger that forces re-assessment and a day on which someone must confirm it has really been retired. For L4 this is the clause that reopens the design gate: a model update, a new release of a payments platform, a change of supplier are substantial changes, and the gate record is re-examined rather than inherited. The three cadences are the minimum distinction an early-warning arrangement must make, because an indicator computed yearly cannot warn of anything.