Evidence and interpretation
A Scoring Factor records an assessor's judgment about a stated condition. Its final answer is binary: 1 for satisfied or 0 for not satisfied. Reaching that answer can involve measured observations, narrative findings, or both.
The bit preserves the decision. The supporting record preserves the evidence and reasoning needed to understand it. See the introduction for how these records fit into the methodology.
Define the condition before judging it
An assessable question needs a clear scope and an evidence rule. For example, “Has the required recovery test succeeded during the review period?” needs an identified service, a defined review period, a description of success, and the records that demonstrate it.
| Part of the criterion | What it establishes |
|---|---|
| System boundary | Which service or component the question concerns. |
| Evidence period | When the observations must have been made. |
| Required evidence | Which records, examinations, interviews, or tests support the answer. |
| Acceptance condition | What must be demonstrated for a positive judgment. |
| Alternatives and missing evidence | How equivalent implementations and incomplete evidence are handled. |
The plain-language explanation and technical description should express the same condition. A reference solution can explain how to meet it, but an operational assessment must establish what was actually observed. See templates for the proposed record structure.
Use measurements and narrative together
Measurements can support a threshold-based condition, such as a count or a response time. The criterion must define the relevant population, observation period, and threshold. Encoding the result does not retain the original measurement or justify the threshold.
Narrative evidence explains observations and their context. Configuration review, interviews, incident review, and testing can produce both numbers and written findings. The type of assessment activity alone does not determine the type of evidence it produces.
For the recovery-test question, the following illustrative evidence leads to different assessment states:
| Evidence available | Interpretation | Outcome |
|---|---|---|
| A successful restoration record for the in-scope service and review period, meeting the stated criterion. | The required success is demonstrated. | 1 after assessor resolution. |
| A completed test record showing that the restoration failed the stated criterion. | The condition is not satisfied. | 0 after assessor resolution. |
| A backup schedule without a restoration result. | The schedule does not demonstrate a successful restore; clarification is needed. | Pending until resolved. |
Pending is a workflow state, not a third encoded value. Missing evidence does not automatically mean failure. Partial fulfillment, uncertain applicability, or conflicting evidence needs an explanation and resolution under the assessment rule before the answer enters the profile.
Keep the reasons with the answer
For each assessment, retain the exact question version, system scope, evidence period, evidence references, assessor identities, and reasons for the judgments. These details help another reviewer distinguish a changed system from changed evidence or a changed interpretation.
When assessors disagree, compare the records they examined and the criterion they applied. They may have used different evidence or interpreted the same condition differently. Validating a Scoring Factor explains how the methodology resolves their judgments; resolution still depends on the quality of the evidence.
Read hexadecimal values as answers
Bit position preserves question identity. It does not establish priority or security significance. For example, 8000 contains one positive answer at SF 0, while 7000 contains three positive answers at SFs 1, 2, and 3. The larger hexadecimal value does not demonstrate better security, and counting positive answers does not establish which requirements matter most.
Stakeholders select their required conditions through requirement masks. Risk analysis may inform that selection, but the encoding does not calculate threat probability, impact, or an organization's risk. It also does not certify compliance or control effectiveness.
When comparing assessments over time, confirm the catalog version and mapping, scope, and evidence period. A changed bit identifies a question to investigate; the accompanying records explain the change. For further context, see questions and answers and resources.