Assessment encoding

A profile preserves the answer to each assessment question in a compact form. Each Scoring Factor (SF) contributes one resolved outcome: 1 when its condition is satisfied and 0 when it is not satisfied. The hexadecimal value encodes those answers; it is not their sum or a security rating.

Start with the introduction for the assessment workflow and validating a Scoring Factor for the rules that resolve assessor judgments. Pending findings remain in the supporting record until resolved; they do not become zero bits by default.

Question and set positions

A Scoring Factor Set (SFS) contains exactly sixteen SFs. Both questions and sets use indices 0 through F: 0–9, then A–F for decimal values 10–15. SFS A is therefore the eleventh set. Here, a catalog means a complete 16 × 16 questionnaire: exactly sixteen sets and 256 questions. A selection of fewer questions is a mask over that catalog. See Scoring Factor Sets for their organization.

Within each set, SF 0 occupies the leftmost, most significant bit, and SF F occupies the rightmost, least significant bit. This is an encoding order; it does not assign security importance to the questions.

SF index: 0 1 2 3 | 4 5 6 7 | 8 9 A B | C D E F
Answer:   1 0 1 0 | 1 0 1 0 | 1 0 1 0 | 1 0 1 0
Hex:         A   |    A    |    A    |    A

Encode one set

Split the sixteen answers into four groups of four bits and convert each group to one hexadecimal digit. Always retain four digits, including leading zeros.

The set value is AAAA. If it belongs to SFS A, write [AAAA]_A, with the suffix identifying the set. SFs 0, 2, 4, 6, 8, A, C, and E are satisfied; the other eight are not.

For comparison, 0001 records only SF F as satisfied, while 8000 records only SF 0 as satisfied. Writing 1 instead of 0001 loses the full four-digit representation.

Identify an individual answer

For an individual answer, the subscript order is SF first, SFS second. The notation below writes subscripts after an underscore so it can be copied as plain text.

Named source positions use SFS/SF order: 3/0 identifies SF 0 in SFS 3, and 2/8 identifies SF 8 in SFS 2. JSON uses sfsId and sfId explicitly. The compact mathematical subscripts above retain their SF-first convention; do not reverse named source fields to match it. See terms and notation.

Report several sets

These are selected-scope set values. Fewer than sixteen fields do not form a complete assessment profile or a smaller catalog; keep each set's index explicit.

Separate set values with colons and identify their set indices. For example, [0123:4567:89AB:CDEF]_1..4 reports SFSs 1 through 4:

These rows also verify the individual examples: SF 0 in SFS 3 is 1, and SF 8 in SFS 2 is 0. To report only sets 1 and 4, write [0123:CDEF]_1,4.

Write a complete profile

A complete profile contains exactly sixteen four-digit fields, ordered by SFS index 0 through F and separated by fifteen colons. It records 256 resolved outcomes.

[0123:4567:89AB:CDEF:FEDC:BA98:7654:3210:0123:4567:89AB:CDEF:FEDC:BA98:7654:3210]_0..F

The first field belongs to SFS 0, the second to SFS 1, and the sixteenth to SFS F. Retain every field so each answer keeps its position.

The manuscript also describes a shortened notation in which an empty field stands for exactly one 0000 set. The separators still preserve all sixteen positions:

Full:
[0123:4567:89AB:0000:FEDC:BA98:0000:3210:0123:0000:0000:0000:0000:0000:0000:3210]_0..F

Shortened:
[0123:4567:89AB::FEDC:BA98:0000:3210:0123:::::::3210]_0..F

An empty field in this notation represents sixteen resolved zero outcomes, not an unknown or pending set. A 0000 assessment field also does not exclude that set from a benchmark; exclusion is expressed in the requirement mask.

Attach the catalog identity, language, and edition described in versioning. To check selected requirements against a profile, continue to requirement masks.

The three MASKS forms take different inputs: a catalog mask takes a complete profile, an SFS mask takes one set value, and an individual-SF mask takes resolved answers only at its selected positions. Expanding a mask to sixteen fields never supplies missing assessment outcomes.