# CHQ-SC-2026-007

- **Artifact ID:** CHQ-SC-2026-007
- **Status:** RATIFIED
- **Public record:** https://record.cybersecurityhq.com/conditions/chq-sc-2026-007
- **Machine-record SHA-256:** `652c8301ca0fd230ca9f46c3149c819b3da4f3a341eb51873bde20f5d589763c`

## Complete structured record

```json
{
  "id": "CHQ-SC-2026-007",
  "name": "Enterprise Application Plane Exploitation",
  "domain": "Data Surface",
  "status": "RATIFIED",
  "persistence": "REINFORCING",
  "first_observed": "2026-06",
  "reinforcement": {
    "date": "2026-07-24",
    "evidence": "A-027",
    "basis": "The dated assumption ledger records July enterprise-application attestation reversals across independently assessed platforms."
  },
  "definition": "The enterprise application layer holding the business record — resource planning, product lifecycle, collaboration, and financial processing platforms — is under confirmed, systematic exploitation as a target class distinct from the network perimeter around it. Four independent platforms have shown confirmed in-the-wild exploitation within one quarter, with ransomware-operator attribution against the class. These systems have been governed as internal and change-controlled, placing them outside the patch urgency reserved for internet-facing infrastructure; the exposure boundary is defined by what the platform holds and whether it answers, not by its position relative to the perimeter.",
  "linked_positions": [
    "CHQ-P-2026-012",
    "CHQ-P-2026-014"
  ],
  "linked_evidence": [
    "A-027",
    "CHQ-P-2026-012",
    "CHQ-P-2026-014"
  ],
  "falsification_condition": "No new confirmed-exploited enterprise application platform in the class (ERP, PLM, collaboration, financial processing) is added to the CISA KEV catalog for two consecutive quarters, AND ransomware or extortion attribution against the class is absent from major incident-response annual reporting (Mandiant M-Trends, Microsoft DFIR caseloads) across the same period, AND no in-the-wild exploitation of a platform in the class is documented by independent telemetry for twelve consecutive months.",
  "evidence_count": 3,
  "last_reinforced": "2026-07-24",
  "linked_assumptions": [
    "A-027"
  ],
  "linked_constraints": [],
  "rating": "CONFIRMED",
  "outlook": "Accumulating",
  "watch": "none",
  "escalation_criterion": "New confirmed-exploited platform in the class (ERP, PLM, collaboration, financial processing)",
  "deescalation_criterion": "Two consecutive quiet quarterly cycles",
  "rating_as_of": "2026-09-22",
  "rating_source": "Structural Condition Report Issue 39",
  "next_review": "2026-09-29"
}
```