Frequently asked questions

Can a high score compensate for a failed legal or safety requirement?

No; the gates are deliberately separate from the weighted total. The need to define service responsibilities is consistent with CISA's customer guidance, while the particular gating method is our editorial design.

Should a brochure count as full evidence?

No; under this scorecard a general claim usually earns no more than 1 until relevant support is provided. Published service terms show why scope and limitations need review beyond a marketing page.

Is this an independent ranking of security providers?

No provider has been assessed or scored. The NIST response guidance supplies context for the criteria, not third-party validation of this rating system.

Can we change the weights?

Yes, before reviewing bids, provided the new weights total 100 and reflect the actual buying purpose. A testing engagement, for example, needs a different emphasis from continuous managed operations.

Does a SOC 2 report earn the maximum assurance score?

Not automatically; review the relevant report's scope, period, exceptions and customer responsibilities. AICPA's description concerns assurance over specified controls rather than a universal performance guarantee.