Appendix A: Control Matrix
Every control in the book against NIST SP 800-171, CMMC, ISO 27001, and the NIST AI RMF.
Appendix B: Cloud Availability Matrix
Every control with its Commercial, GCC, GCC High, and DoD status, each cell dated and marked documented or observed.
Appendix C: Tenant Checks
Look-only checks, by chapter, that turn a documented claim about a cloud into an observation.
Appendix D: Audit Schema
The CopilotInteraction record and its agent, plugin, and detection fields.
Appendix E: Field Notes
Where the clouds diverge from the documentation, as observed.