Scoring Factor Sets
A Scoring Factor Set (SFS) groups exactly sixteen Scoring Factors (SFs), indexed 0 through F. Each SF is one binary question together with its criteria and supporting records. The manuscript organizes its initial catalog into sixteen security focus areas, with one SFS per area.
A completed assessment supplies one resolved bit for each SF. Write the sixteen bits in question order, from SF 0 on the left to SF F on the right, and encode each group of four bits as one hexadecimal digit. The SFS result therefore uses exactly four hexadecimal digits, retaining leading zeros. For example, 1010 1010 1010 1010 becomes AAAA. A larger hexadecimal value does not imply lower risk or better security: the value preserves the identities of the satisfied and unsatisfied questions.
The set definition groups questions; a separate assessment applies those questions to a system and evidence period. An SFS is not an aggregate risk score or a compliance certificate. Read the methodology for the process and encoding for bit placement and requirement comparisons.
The hierarchy is Catalog → sixteen SFSs → sixteen SFs per SFS, giving 256 question positions in this draft. Question explanations and records belong to the SF, rather than forming another catalog level.
Use this page to understand where a condition belongs. The area descriptions are a draft organization of questions, not a validated coverage model for a particular sector.
Related sets can address different aspects of the same system. A catalog should document primary ownership, overlap, and exclusions rather than count the same evidence as independent proof of several conditions. The scope boundaries below guide authoring and remain subject to review.
Browse the sixteen placeholder questions in every set. These are unreviewed authoring positions, with unfilled votes and results, rather than usable assessment criteria.
Start with question records to define an SF, or assessment encoding to read a completed set.
[0] Operating System and Workstation Environment
View the sixteen question placeholders →
Assess how operating systems and workstations are provisioned, maintained, and protected, including remote use, shared storage, device encryption, and operational logging.
This set covers the working environment used by staff and administrators, including local, diskless, and remote workstations. It considers asset identification, approved system images, patching, local data, shared file systems, and the handling of device decryption keys. Its questions should identify the devices and review period in scope and connect each condition to configuration or operational evidence. Privileged access is addressed in SFS 1, recovery testing in SFS 2, and central monitoring in SFS 6.
Keywords: operating systems, workstations, endpoint inventory, provisioning, patching, diskless clients, remote desktops, shared storage, device encryption, endpoint logging.
[1] Administrator and Master Keys
View the sixteen question placeholders →
Assess the ownership, protection, use, and recovery of privileged accounts, administrator credentials, master keys, and other high-impact secrets.
This set covers secrets and permissions whose misuse or loss could compromise administration or make protected data unrecoverable. It includes named administrators, separation of duties, secret storage, emergency access, credential rotation, revocation, and traceable privileged actions. Evidence should show who can use a secret, how access is authorized, and how changes and recovery are controlled. General user authentication belongs to SFS 3; cryptographic algorithms and service configuration belong to SFS A.
Keywords: privileged access, administrator accounts, master keys, secrets, vaults, separation of duties, emergency access, rotation, revocation, audit trails.
[2] Backup and Disaster Recovery Plan
View the sixteen question placeholders →
Assess whether documented backup and recovery arrangements can restore the required services and data within defined recovery objectives.
This set covers continuity planning, backup ownership, protected backup copies, restoration procedures, service dependencies, and recovery exercises. It distinguishes having a backup configuration from demonstrating that a restoration succeeded. Questions should state the service boundary, required recovery objectives, evidence period, and conditions for a successful test. Evidence may include recovery plans, backup job records, and restoration reports. Routine storage management and retention belong to SFS 4; incident coordination belongs to SFS 6.
Keywords: backups, disaster recovery, business continuity, recovery objectives, redundancy, restoration tests, backup integrity, recovery plans, service dependencies.
[3] Authentication and Authorization
View the sixteen question placeholders →
Assess how identities are verified, accounts are managed, and access permissions are granted, reviewed, and withdrawn.
This set covers user and service identities, authentication services, federation, directory services, password handling, multifactor authentication, sessions, and role-based access. It also considers account creation, permission review, and timely removal of access. Each question should specify the identities and resources in scope and the evidence needed to show that the access rule is applied. Special handling of administrator and master credentials belongs to SFS 1; authorization across service interfaces is coordinated with SFS C.
Keywords: identity management, authentication, authorization, account lifecycle, federation, LDAP, passwords, multifactor authentication, sessions, role-based access, access reviews.
[4] Data Storage and Handling
View the sixteen question placeholders →
Assess how data is classified, stored, accessed, shared, retained, and deleted across local, network-attached, and cloud storage.
This set covers the lifecycle of data and documents, including ownership, storage locations, access rules, encryption, sharing, retention, deletion, and privacy-related handling conditions. Questions should identify the relevant data classes and systems and connect the stated policy to observable configuration or records. Storage copies and protection belong here, while demonstrated restoration and recovery objectives belong to SFS 2. Cryptographic services are addressed in SFS A, and cross-system interfaces in SFS C.
Keywords: data classification, data ownership, network-attached storage, cloud storage, document management, encryption, data sharing, retention, deletion, privacy.
[5] Networking and VPNs
View the sixteen question placeholders →
Assess network boundaries, segmentation, remote connectivity, and traffic controls, including VPNs, security groups, and zero-trust access policies.
This set covers how devices and services communicate within a system and across external boundaries. It includes network inventories, routing, firewall and security-group rules, protected remote access, VPN configuration, and review of allowed connections. Questions should identify the relevant network paths and the evidence that demonstrates an enforced restriction or approved connection. Identity decisions belong to SFS 3, application-level protocol behavior to SFS C, and detection and response to SFS 6.
Keywords: network inventory, segmentation, firewalls, security groups, routing, VPNs, remote access, zero trust, traffic controls, network review.
[6] Logging, Monitoring, and Incident Response
View the sixteen question placeholders →
Assess whether relevant events are recorded, monitored, investigated, and handled through defined incident-response procedures.
This set covers event sources, central log collection, record integrity, time consistency, monitoring coverage, alert handling, and incident escalation. It includes endpoint protection and deception mechanisms such as honeypots where they are part of the declared system. Questions should specify which events and services are monitored and what evidence demonstrates detection or response during the review period. Recovery after disruption belongs to SFS 2, while organizational authority and policy ownership belong to SFS D.
Keywords: logging, monitoring, audit trails, log integrity, time synchronization, alerts, endpoint protection, honeypots, incident response, escalation.
[7] Software Development Lifecycle
View the sixteen question placeholders →
Assess how software moves through requirements, design, implementation, testing, release, operation, and decommissioning with traceable changes.
This set covers the delivery process for applications and services, including source control, build inputs, CI/CD pipelines, test execution, release approval, deployment, rollback, and retirement. Its questions should make ownership and the relationship between source changes and delivered artifacts explicit. Evidence may include repository records, pipeline results, and deployment records. Security requirements and risk treatment belong to SFS 8, independent security findings to SFS 9, and interface-specific controls to SFS C.
Keywords: software lifecycle, requirements, design, source control, CI/CD, build provenance, testing, release approval, deployment, rollback, decommissioning.
[8] Secure Development Lifecycle and Risk Management
View the sixteen question placeholders →
Assess how security requirements, secure coding, threat analysis, and risk decisions are integrated into software engineering.
This set covers the security work performed throughout development, including identifying applicable requirements, analyzing threats, reviewing designs, handling dependencies and secrets, and recording risk-treatment decisions. Questions should ask about specific practices or evidence-backed conditions, rather than treating an aggregate score as a measure of risk or compliance. The general delivery process belongs to SFS 7, security test findings to SFS 9, and organizational approval authority to SFS D.
Keywords: security requirements, secure coding, threat analysis, design review, dependency management, secrets handling, risk management, risk treatment, security review.
[9] Software Security Auditing
View the sixteen question placeholders →
Assess how software security reviews and tests are scoped, performed, documented, and followed through to verified findings.
This set covers vulnerability assessment, penetration testing, black-box and white-box review, and security testing of applications and services. Questions should identify the tested version, system boundary, procedure, evidence period, and criterion for accepting a finding or remediation. Reports and retest results support individual judgments; the presence of an auditing tool alone does not demonstrate effectiveness. Development practices belong to SFS 8, delivery records to SFS 7, and live incident monitoring to SFS 6.
Keywords: security auditing, vulnerability assessment, penetration testing, black-box testing, white-box review, application testing, findings, remediation verification, retesting.
[A] Cryptographic and Blockchain Infrastructure
View the sixteen question placeholders →
Assess how cryptographic services protect data and establish integrity or authenticity, including blockchain-based components when they are in scope.
This set covers cryptographic choices and configuration, certificate handling, digital signatures, encryption services, and the lifecycle of their keys. Blockchain-specific questions apply only where a declared component uses that technology and should identify its trust assumptions and verification evidence. Questions must distinguish a configured mechanism from evidence that it satisfies the stated condition. Administrative custody of master keys belongs to SFS 1, data-handling rules to SFS 4, and device trust mechanisms to SFS B.
Keywords: cryptography, encryption, integrity, digital signatures, certificates, key lifecycle, trust assumptions, blockchain, cryptographic configuration.
[B] Hardware-Oriented Security and IoT Auditing
View the sixteen question placeholders →
Assess the trust, maintenance, and protection of hardware and Internet of Things devices, including secure boot, firmware, and physical access.
This set covers device inventories, hardware trust mechanisms, firmware provenance and updates, exposed interfaces, physical and environmental safeguards, and device retirement. Questions should identify the device classes, supported configurations, and evidence needed to establish the stated condition. The scope includes IoT devices where they form part of the assessed system. Workstation operating-system management belongs to SFS 0, network controls to SFS 5, and application protocols to SFS C.
Keywords: hardware security, IoT, device inventory, secure boot, firmware provenance, firmware updates, physical access, environmental safeguards, device interfaces, retirement.
[C] Interfacing Protocols and APIs
View the sixteen question placeholders →
Assess the trust boundaries and behavior of interfaces used to exchange data or commands between services, devices, and external systems.
This set covers API contracts, message protocols such as MQTT, interface authentication and authorization, input validation, error handling, and control of exchanged data. It includes integration tests and mock interfaces where they support verification. Questions should identify the communicating parties, allowed operations, and evidence that the interface enforces its stated conditions. Network transport restrictions belong to SFS 5, identity management to SFS 3, and data lifecycle rules to SFS 4.
Keywords: APIs, MQTT, service integration, interface contracts, trust boundaries, authentication, authorization, input validation, data exchange, mock APIs, integration testing.
[D] Roles, Responsibilities, Authorities, and Security Policy
View the sixteen question placeholders →
Assess whether security duties, decision authority, policies, and operating procedures have clear owners and documented review arrangements.
This set covers organizational accountability, policy approval, responsibilities, exception decisions, supplier oversight, workforce awareness, and escalation authority. Questions should connect each duty to an identified role and evidence that the relevant procedure has been communicated or followed. Governance defines who is responsible and authorized; technical enforcement is assessed in the relevant infrastructure or application set. Operational incident handling belongs to SFS 6, while engineering risk-treatment practices belong to SFS 8.
Keywords: security governance, roles, responsibilities, decision authority, policies, procedures, exceptions, supplier security, workforce awareness, accountability.
[E] AI-Oriented Ethics (Training and Implementation)
View the sixteen question placeholders →
Assess the ethical and accountable practices used to source data, develop, train, test, and prepare AI systems for deployment.
This set covers the provenance and permitted use of training data, documentation of model choices, evaluation of bias and fairness, privacy considerations, and responsibility for approving deployment. Questions should state the intended use, relevant populations, evidence, and acceptance criterion. Ethical findings must remain distinguishable from security controls such as access permissions and protection of training inputs. General engineering practices belong to SFS 7 and SFS 8; behavior and oversight after deployment belong to SFS F.
Keywords: AI development, training data, data provenance, permitted use, model documentation, bias evaluation, fairness, privacy, evaluation, deployment approval.
[F] AI-Oriented Ethics (Live Systems)
View the sixteen question placeholders →
Assess fairness, transparency, accountability, and human oversight in operating AI systems and their interactions with users and other services.
This set covers the declared use of a deployed AI system, communication of its limitations, monitoring of its behavior, review of harmful or biased outcomes, and routes for human intervention or redress. Questions should identify the operating context, affected users, review period, and observable evidence. Ethical criteria remain distinct from security conditions involving permissions, untrusted inputs, or system access. Training and predeployment evaluation belong to SFS E, and general event handling belongs to SFS 6.
Keywords: AI operations, fairness, transparency, accountability, human oversight, limitations, behavior monitoring, harmful outcomes, intervention, redress.
Review the coverage
A complete catalog must map its individual questions to the areas and identify any gaps or overlap. The manuscript highlights asset inventories, supplier security, workforce awareness, physical protection, data retention and deletion, and the distinction between AI ethics and AI security as topics requiring explicit ownership.
Keep each question tied to its catalog author, language, and immutable edition. See catalog versioning before comparing sets from different releases.
The sixteen-question limit per set is a design constraint. It should not be met by combining unrelated conditions into a single question. Read assessment and validation for consistent criteria and about the project for the evaluation plan.