Methodology, sources, and limits

Scoring is deterministic and explainable

• The same answers always produce the same score. Scoring is rule-based arithmetic, not a model and not a judgement call — a regression suite locks the engine against silent drift.
• Every number carries its own explanation: the formula that produced it, the version of the methodology it used, and the specific rule behind each finding.
• “Not applicable” never counts as zero. An N/A question leaves the calculation entirely instead of quietly dragging the score down.
• Maturity is banded separately from score, and a mandatory gate can cap it: L1 Reactive, L2 Repeatable, L3 Standardized, L4 Measured, L5 Optimized.
• Operational risk is computed independently of maturity — a mature-looking practice with a missing critical control still reads as high risk.
• Evidence confidence annotates a result; it never changes the score. High maturity with weak evidence is labelled as self-reported rather than silently trusted.

Methodology is versioned, and results are frozen

An assessment is pinned to the template and scoring-model version in force when you started it. Completing a run freezes its inputs and outputs: later edits to our questions or rules can never rewrite a result you already have. That is also why a comparison between two runs shows deltas only when both used the same methodology — when it changed, we say so and show no numeric trend rather than pretending the two are comparable.

Where the content comes from

Recommendations, runbooks and checklists are editorial content with named sources. Every source carries a tier, so you can weigh guidance by its provenance:

Tier 1 — Primary

Standards bodies; official cloud/vendor or framework documentation; regulatory text; original research/specification.

Tier 2 — Authoritative

Recognized industry organizations; respected reference books/guides; established engineering publications.

Tier 3 — Practitioner

High-quality field experience; reputable engineering blogs; conference material.

Published content carries a review stamp and a next-review date. A recommendation cannot be published without explicit validation criteria and at least one backing source.

Where AI is — and is not

The product works completely with AI switched off, and that is the default. Where an optional AI layer is enabled, its role is strictly limited:

• AI never scores. No model output becomes a score, maturity level, risk rating, priority, control completion, or authorization decision. Those are computed by rules, always.
• It can suggest which technologies your written description mentions — and you confirm or reject each suggestion before anything is saved.
• It can rephrase results that are already final into executive wording, alongside the deterministic summary, clearly labelled as generated.
• It receives the minimum context needed: frozen result numbers and approved catalog text. It is never sent your evidence files, and input that looks like a credential is refused before it leaves our server.

See the privacy policy for what an enabled AI layer sends, and to whom.

Honest limits

• Results are only as good as the answers. We cannot detect an optimistic self-assessment.
• Coverage is uneven: some operations areas are deeply published, others are still being written. An area with thin content will say so rather than invent guidance.
• The roadmap orders work by a published priority formula — it is a starting point for a conversation with your team, not a plan handed down.
• This is a single-region service on modest infrastructure. It is not highly available, and we do not claim otherwise.