Assessment Methodology
Determinism and reproducibility
The same evidence produces the same score, and every pack prints what it would take to reproduce the number it reports.
Deterministic
Nothing in the scoring samples, estimates or varies between runs. Given the same evidence, the engine produces the same score, the same band and the same ordering of findings.
What the pack records
Every board pack carries the inputs that determine its own result:
| Recorded | Why it matters |
|---|---|
| Engine version | The scoring implementation that produced the number |
| Scanner version | Which checks existed, and therefore what the denominator was |
| Severity scope | Which severities were collected at all |
| Scan regions | What was in scope |
| Evidence confidence | Whether the rating was supportable |
| Generation time | When the environment was observed |
The scoring fingerprint
The engine derives a fingerprint from the scoring constants in force at the time. It is stored with the assessment, and the next assessment compares it.
If the constants changed between two assessments, the composite and domain scores are not compared, because the two numbers were produced by different rules. Control-level movement continues to be reported, because control identifiers are stable across engine versions.
That gating is what stops a methodology change being presented to a board as an improvement in their environment.
Why the scanner version is pinned
The scanner's version is pinned and recorded as part of the methodology, not treated as an implementation detail. An upgrade changes which checks run, which changes the denominator of the pass rate, which changes every score, silently. Pinning makes that a deliberate, reviewable change.