Sources & methodology

You should always be able to see who said something, when, and how much weight it deserves.

Source types

Label	Examples	How we use it
Standards body	ISO	Source of record for what a standard is and its current edition. We summarise; we never reproduce copyrighted standards text.
Professional body	AICPA	Source of record for SOC 2 and the Trust Services Criteria.
Government	NIST, CISA	Security frameworks and guidance.
Auditor / certification body	CPA firms, accredited certification bodies	How examinations and certification work in practice, where the standards bodies' own material is paid or not public.
Vendor (official)	A platform's own website	Facts about that vendor only: what it says it does, frameworks it lists, whether it publishes prices.
Third-party estimate	Cost ranges published by auditors, vendors or publishers	Shown only attributed to the publisher, with its currency, scope and date. Never averaged into a figure of our own.

Cost figures

For the Cost & Readiness Index we record, for each figure: the publisher and what kind of firm it is, the exact range and currency, what the figure covers, when it was published, the quote it comes from and when we last checked it. Figures are not converted between currencies or combined. Several publishers sell the services they price; the index says so.

Vendor facts

Platform descriptions are quoted from each vendor's own site. Framework lists are what the vendor states. A price appears only if the vendor publishes one, with the pricing page linked.

Freshness

Kind of fact	Re-verified at least every
Vendor facts and prices	45 days
Cost figures	45 days
Framework and standards facts	180 days
Evergreen explanations	365 days

Our publishing system refuses to publish a page or record whose facts are older than these limits, and our monitoring flags them in advance.

The readiness assessment

The assessment is a fixed, published scoring rule that runs in your browser; the rule is explained on the page. It uses no AI and stores nothing.