Introduction

UNIQ²Me is a reporting and comparison methodology for a bounded catalog of cybersecurity questions. Its central idea is to preserve the identity of every answered requirement while providing a compact profile that different readers can check against their own needs.

Why a total score is not enough

Two services can satisfy the same number of requirements and still fail different mandatory controls. A purchaser may need an acceptance decision, an operator may need remediation tasks, and an assessor may need to inspect the evidence.

A total hides which conditions failed. A full report retains the detail but can be difficult to navigate. UNIQ²Me connects a compact representation to the questions and records behind it.

The building blocks

A catalog means the complete 16 × 16 questionnaire: exactly sixteen sets and 256 questions. Masks select subsets of those requirements. Indices start at zero: A has decimal index 10 and denotes the eleventh position.

An SFS or individual-SF comparison is a selected-scope assessment, not a smaller catalog or complete profile. The terms and notation guide distinguishes these records from deployment instances and template versions.

Separate the definition from its answer

Consider the question:

Has the required recovery test succeeded during the review period?

The definition states what constitutes a successful test, which service is covered, what evidence is required, and which alternatives are acceptable.

An assessment instance adds the actual service, review period, restoration records, and assessor decisions. Two organizations can use the same definition and legitimately obtain different answers. One organization may also receive a different answer when it is reassessed later.

A reference recovery procedure describes what to do. Only the organization's evidence can show whether its required test succeeded.

The assessment workflow

1. Define one assessable condition in plain language.
2. Record the relevant scope, evidence, assessor judgments, and explanations.
3. Resolve the judgment to 1 for satisfied or 0 for unsatisfied.
4. Place each resolved answer in its assigned SF position.
5. Encode each sixteen-bit set as four hexadecimal digits.
6. Apply a compatible mask and retrieve the records for unmet requirements.
7. Retain the catalog identity and assessment context alongside the profile.

Pending evidence remains in the assessment workflow until resolved. It is not silently converted into a negative answer.

Different readers, one assessment

A service owner can select recovery conditions while a purchaser selects acceptance conditions. Their masks can differ without requiring the underlying assessment to change, provided both checks use compatible question definitions, ordering, scope, and evidence periods.

A selected requirement passes when its assessment bit is 1. A mask bit of 0 excludes that question from the check; it does not require the answer to be negative.

The MASKS library groups selections into complete catalog masks, SFS masks and individual-SF masks. Each records its purpose, system scope, evidence period and exact catalog binding. Draft selections need review before operational use.

What the method contributes

The hexadecimal notation and Boolean operations are established techniques. UNIQ²Me organizes questions, judgments, version annotations, and stakeholder selections around them so that a failed requirement leads back to a specific condition and its supporting record.

The method records implementation or a defined outcome. It does not itself measure risk, collect telemetry, discover regulatory mappings, or grant authority for an exception. Those functions belong to the surrounding assessment process.

Continue reading

Start with the sixteen security areas, then learn to define question records and resolve assessor judgments. The encoding guide and mask guide explain the deterministic calculations.