How Claims on This Site Are Graded
How sources are graded
The regulation, the statute, the Federal Register notice, the CMVP certificate, the agency memo.
How it may be usedStated plainly, with the citation in the text so you can check it.
Law firms, trade press, standards bodies, and others with no product to sell you on the question at hand.
How it may be usedUsed freely, attributed, and never upgraded into a primary source.
A vendor's own documentation or marketing about its own product.
How it may be usedFine for what a product does. Never used for whether a product is compliant, and never as the basis for a competitive claim.
One origin, repeated widely enough to look like consensus. Common in this field, and the most dangerous grade precisely because it reads as settled.
How it may be usedTraced to the origin before use. If the origin cannot be reached, the claim is not made.
The rules that follow from it
- Nothing graded opinion or unverified is published without saying so in the copy itself.Not in a footnote, not on a methodology page. In the sentence.
- A number that can be derived is shown being derived.The lowest possible SPRS score is -203. No DoD document states that figure. It is 110 minus the 313 points codified at 32 CFR 170.24, and this site shows that arithmetic rather than asserting the number the way the rest of the market does.
- An absence of evidence is labelled as an absence of evidence.Several claims about which vendors hold which authorizations rest on the vendor never having claimed it. That is weaker than a negative finding, and it gets described that way.
- Popularity is not accuracy.The most upvoted answer in a practitioner community is a signal about which questions matter, not about what is true. Community discussion is used to choose topics. The citation is always the primary source.
- A claim about what is in the product is checked against the built archive.Not against a manifest, not against a note. Against the file a buyer actually downloads.
What that looks like in practice
It is often said that a contractor can decide CUI no longer needs protection once it has been aggregated, redacted or otherwise transformed. 32 CFR 2002.18 places decontrol authority with the designating agency. This site does not repeat the contractor-side framing, however commonly it appears, because acting on it is a compliance risk for the reader.
A vendor announcing an intent to pursue FedRAMP authorization is not the same as a listing on the FedRAMP Marketplace, and neither is the same as an authorization at a given impact level. This site uses the wording that matches the actual status, which sometimes makes a favourable claim sound weaker than a competitor's version of it.
A third-party search API once reported this site as entirely unindexed across every query, including its own brand name. Checking by hand showed real positions on real queries. A tool reporting absence is not evidence of absence until the ground truth is checked, and that principle now applies to every automated measurement used here.