How we assess
A method you cannot inspect is not a method. This is the whole of it, published so you can argue with it before you buy anything.
The scoring scale
Every control is scored on four levels, and the distinction between the middle two is the entire instrument:
| Level | What it means |
|---|---|
| 0 — Absent | Nothing exists. No named owner, no document, no practice. |
| 1 — Informal | It happens in practice but is undocumented, unowned, or inconsistent between sites. |
| 2 — Documented | The artifact exists and is approved, but there is no record of it operating in the last twelve months. |
| 3 — Operating | The artifact exists, is current, and you can produce dated evidence that it ran. |
Most organisations score well on documentation and badly on operation. That gap is the finding, and it is why we do not accept a policy as evidence of a control.
What counts as evidence
A dated artifact, and a record showing it operated. A policy nobody has run is a 2. A committee that meets but keeps no minutes is a 1. A dashboard nobody reads is a 1 regardless of how good the dashboard is.
We read the floor, not the average
Readiness fails at its weakest artifact. A total score is useful for tracking movement over time and almost useless for deciding what to do next, so every assessment reports the weakest area first and the total second.
What we will not do
- We do not rank vendors. We publish an evaluation method instead. Maintaining accurate vendor data in a category that churns monthly is a full-time job, and a stale listing destroys the neutrality everything else depends on.
- We do not publish a state law tracker. Firms that do this update weekly and fund it from a different business. A stale tracker is worse than none.
- We do not take vendor money. No sponsorship, no equity, no referral fees, no paid placement. A vendor cannot buy a mention, a ranking or a recommendation.
- We do not present composites as real organisations. Case studies drawn from multiple engagements are labelled as composites wherever they appear, and a composite never supplies a figure that another part of the argument depends on.
Where our evidence stops
Every quantitative claim we publish carries a dated, named source in the sentence. Where a figure could not be verified against a primary source, we say so rather than substituting a plausible number. A reference that tells you where its evidence stops is more useful than one that does not.