Requirement masks

A benchmark checks whether an assessment satisfies a chosen set of requirements. A requirement mask selects the questions needed for that decision, allowing different readers to check different requirements against the same profile.

A catalog is the complete 16 × 16 questionnaire, with 256 fixed question positions. A mask selects requirements within that catalog; it does not create a smaller catalog. Open the MASKS library to inspect draft mask records, see their selected questions and try the comparisons below.

The assessment and mask must use compatible question definitions, bit ordering, system scope, and evidence period. Retain the catalog version and use the fixed positions described in assessment encoding.

Three forms, one catalog

Each form normalizes to sixteen requirement-mask fields. An SFS selection excludes all other sets; an individual-SF selection requires exactly its named positions. This expansion supplies zeros in the mask, not negative answers for unassessed questions.

An SFS or individual-SF check reports its selected scope. It must not be presented as a complete catalog assessment. In an individual-SF comparison, pending selected answers block the result; unselected questions remain outside the check. See terms and notation.

Select required positive answers

Each mask bit has one meaning:

A zero mask bit does not require a negative answer. Masks select positive requirements only; they do not express a requirement for an SF to fail.

Write each set's mask as four hexadecimal digits, preserving leading zeros just as for an assessment.

Check satisfaction and locate gaps

Let S be the assessment and M the requirement mask. AND compares matching bit positions and returns 1 only when both inputs are 1. The intersection R retains selected requirements that are satisfied.

R = S AND M
Pass when R = M

D = R XOR M

XOR returns 1 where its inputs differ. Each 1 in D therefore identifies a selected requirement that is unmet. When D is 0000, the set has no unmet selected requirements.

If a mask selects no requirements, report No requirements selected. The empty selection does not establish an assessment finding.

Worked example: AAAA against EAB2

Suppose SFS A has the assessment AAAA. Its alternating answers satisfy SFs 0, 2, 4, 6, 8, A, C, and E.

The benchmark requires SFs 0, 1, 2, 4, 6, 8, A, B, and E. Setting those mask bits to 1 gives EAB2:

SF index: 0 1 2 3 | 4 5 6 7 | 8 9 A B | C D E F
S:        1 0 1 0 | 1 0 1 0 | 1 0 1 0 | 1 0 1 0
M:        1 1 1 0 | 1 0 1 0 | 1 0 1 1 | 0 0 1 0

AAA2 differs from EAB2, so the benchmark fails. Reading 4010 from SF 0 at the left identifies SFs 1 and B as the two unmet selected requirements. The reviewer can return to those questions and their supporting evidence.

Write this comparison as [AAAA/EAB2]_A. The slash separates assessment and mask; it is not division. SF C is satisfied but excluded by this mask, so it has no effect on the result.

Worked example: recovery requirements

Consider an illustrative set whose first four questions concern a documented recovery plan, a successful restoration test during the review period, an assigned recovery owner, and a current backup inventory. Assume the remaining twelve outcomes are resolved zeros.

The assessment is B000. A mask requiring all four conditions is F000.

R = B000 AND F000 = B000
D = R XOR F000 = 4000

The unmet result 4000 points to SF 1, the restoration test. Once the test succeeds and the assessor accepts the evidence, the assessment becomes F000 and passes this mask. This checks the four stated conditions; it does not establish legal compliance. See use case examples for the wider context.

Check multiple sets

For a complete profile, pair each of its sixteen SFS fields with the mask field at the same index, from 0 to F. Apply AND and XOR separately to every pair. The profile passes only when every selected requirement in every set is satisfied.

A mask field of 0000 selects no requirements in that set. An assessment field of 0000, by contrast, records sixteen negative outcomes; it fails any positive requirements selected for that set. Keep pending findings outside the binary profile until assessor judgments are resolved.

The draft catalog example combines F000 in SFS 2 with EAB2 in SFS A, selecting thirteen positions. Synthetic set values B000 and AAAA produce unmet fields 4000 and 4010, identifying 2/1, A/1 and A/B. The individual-SF example selects those three positions explicitly. These are arithmetic examples; the current catalog records remain placeholders and do not contain the hypothetical recovery criteria above.

Record and review a mask

Keep one editable JSON source per mask in uniq2me/repo-sfs-masks/<language>/<id>.json. The filename matches the ID. The version-1 schemas/mask.schema.json describes the record; the SF-authoring design is a separate format. The catalog mask authoring guide explains the source schema and editable starters.

Copy a matching starter from repo-sfs-masks/templates/, identify the target snapshot and review the selected questions. Keep the record draft while definitions, mapping or assessment context remain unresolved. Promotion to reviewed requires a published catalog edition, a named maintainer and an accepted review with at least one named reviewer and a recorded review timestamp.

A change to the selection or catalog binding needs a new revision and review. A later review of unchanged content keeps its own timestamp; it does not change the catalog edition. Published artifacts should preserve earlier revisions immutably. The current implementation validates the record structure and required review metadata; human review establishes the suitability of the selection.

The library disables comparison when a mask's bound digest differs from the deployed catalog. Review the definitions and mapping before updating that binding. An English fallback retains its original catalog identity; changing the interface language does not establish equivalence with translated definitions.

Interpret the result

The benchmark reports which selected conditions are satisfied and which remain unmet. It does not rank organizations, assign risk weights, or turn a larger hexadecimal value into a better security result. A passing mask supports only the selected requirements under the stated assessment conditions.

The comparison interface accepts manually entered answers. Digest compatibility checks the deployed questions and mask; it does not verify the provenance, scope or evidence period of a pasted assessment. Retain and review those assessment records separately.

Use the qualitative assessment guidance to understand the evidence behind an answer and the questions and answers for further interpretation.