UNIQ²Me
Unified Qualitative and Quantitative Measurements for Cybersecurity Assessment.
UNIQ²Me connects each yes/no assessment answer to its question, evidence, and assessor's reasons. A compact profile preserves which conditions are met, while a requirement mask selects the conditions relevant to a particular decision.
Learn the method or explore the questions
Browse UNIQ²Me teams and SFS deployments →
| Reading path | What you will find | Start here |
|---|---|---|
| Methodology | How to define questions, assess evidence, resolve judgments, encode answers, and check requirements. | Read the methodology |
| Catalog | What an SFS and an SF contain, the sixteen security areas, and each of the 256 draft question positions. | Explore the catalog |
| MASKS | Catalog, SFS and individual-SF requirement selections bound to an identified catalog. | Explore MASKS |
The methodology explains the process, the catalog defines what gets assessed, and MASKS selects the requirements for a particular decision. The terms and notation guide distinguishes set values, complete profiles and selected-scope assessments.
Understand the hierarchy
Catalog — 16 sets, 256 questions
└── Scoring Factor Set (SFS) — one area, 16 factors
└── Scoring Factor (SF) — one question and its criteriaAn SF is the question; there is no extra layer of sixteen questions under each SF. Both set and factor positions run from 0 to F. The question's explanations, evidence rule, and supporting records belong to that same SF.
Read what an SFS is, what an SF is, or browse all 16 × 16 positions. For example, SFS 2 / SF 1 identifies one question position in the recovery area.
How the method works
- Define one condition and its evidence rule within an identified catalog edition.
- Assess a real system within a stated boundary and review period.
- Record and resolve one or three assessors' judgments, retaining the evidence and reasons.
- Encode the sixteen accepted
0/1answers of each SFS as four hexadecimal digits. - Apply a requirement mask and trace unmet conditions back to their question records.
Pending findings are not silently encoded as failures. The hexadecimal profile is not a sum, a risk ranking, or a compliance certificate.
The methodology overview walks through the process with a bounded recovery example. Continue with evidence, assessment, encoding, and requirement masks.
Current catalog status
249 model-reviewed questions; 7 pending positions. Latest published phase: catalog. This is an authoring draft; no human approval or operational assessment is claimed. Read the current catalog.
Contribute
Start with question records to develop a definition, see the FAQ, or contact the author with corrections and sanitized examples.