Assessment Methodology
& Limitations
The short version
This assessment is a structured professional opinion — not an audit, not a penetration test, not a certification. Its results are built entirely from the answers you gave us, which we have not independently verified. It reflects your position on the day you completed it, and nothing after that.
Our scoring draws on published security frameworks, combined with our own weighting and our own growth-exposure model. Those organisations are not affiliated with us and have not reviewed or endorsed this instrument.
Everything here is a recommendation. Acting on it reduces risk. It does not eliminate it, and no one can honestly promise otherwise. Decisions about your business remain yours.
01What this assessment is
The Grow & Protect Assessment is a structured professional opinion about two things: how well your organisation is positioned to grow, and how well that growth is protected. It produces a score for each side and describes the gap between them.
It is a diagnostic and prioritisation tool. Its purpose is to tell you what to do first — not to certify what you have already done.
02How the result is produced
We publish our method rather than hiding it, because a score you cannot interrogate is a score you should not trust.
- You answer a fixed set of questions. Each maps to a single control — a specific, nameable thing that is either in place or is not.
- Each control carries a weight reflecting how much we judge it matters for an organisation of your size and exposure. Weights are visible to you, and can be adjusted where your circumstances justify it.
- Most controls are scored on a scale. Your answers are combined into a weighted percentage for Grow and for Protect.
- Some controls are gates. These are pass/fail in the real world, so we treat them that way. A gate failure — a default or shared password, no multi-factor authentication on administrative access, an untested backup — caps your Protect score regardless of how strong everything else is. We show the uncapped figure alongside it so remediation progress stays visible.
- Your growth profile scales your exposure. More staff, more records, more vendors and faster growth all increase the surface that has to be defended. This is what produces the growth/gap figure.
03What our scoring draws on
Our control set and our reasoning are informed by published, independent work, including:
- CIS Critical Security Controls v8.1, particularly Implementation Group 1
- NIST Cybersecurity Framework 2.0
- Verizon Data Breach Investigations Report (current and prior editions)
- Canadian Centre for Cyber Security baseline controls for small and medium organisations
- Common cyber-insurance underwriting requirements
- Where relevant to a specific client: SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A
None of these organisations is affiliated with Redefine Logic Media, and none has reviewed, approved, endorsed or certified this assessment. We reference them to show our reasoning and to help you connect our recommendations to standards you may already answer to. All trademarks belong to their respective owners.
Alignment with a framework is not compliance with it. Compliance is determined by an accredited assessor against that framework’s own requirements, which this assessment does not replicate.
04What is ours
Two things in this instrument are our own work, and are not drawn from any published framework:
- The weighting model — how much each control counts, and which controls we treat as gates. This is our professional judgement, informed by the sources above but not derived from them. Reasonable practitioners could weight these differently.
- The growth/gap model — the relationship we draw between commercial visibility and security exposure, and the combination of digital growth controls with security controls in a single instrument. This is the part that makes the assessment ours, and the part with the least external precedent.
We say this plainly because it matters: the security frameworks lend credibility to our inputs. They do not validate our formula.
05What this assessment is not
Do not rely on this as
Each of the following is a distinct professional service. This assessment is none of them.
- An audit. Nothing here has been independently verified, sampled or tested.
- A penetration test, vulnerability scan or red-team engagement. No system was accessed, scanned or probed.
- A certification or attestation. It confers no status and satisfies no regulator, insurer or procurement requirement on its own.
- Legal or regulatory advice. Whether you meet your obligations under PIPEDA, PHIPA or any other statute is a determination for qualified legal counsel and, where applicable, for you as the accountable custodian.
- Insurance advice, or any indication of insurability. A strong score is not a representation that a policy will be issued or a claim paid.
- A financial projection. Growth-side recommendations describe practices associated with better commercial outcomes. They do not forecast revenue.
- A guarantee that an incident will not occur.
06What the result depends on
Every input is self-reported and unverified. The output can only ever be as accurate as the answers given. Where an answer was uncertain, optimistic, or given by someone without full visibility of the environment, the result will be wrong in that direction — and we will have no way of knowing.
This is the single largest limitation of the instrument. If you want verified findings rather than a structured opinion, that is a different engagement, and we will tell you so rather than let a score stand in for evidence.
The result is a point-in-time snapshot. Security posture changes when a system is patched, an employee leaves, a vendor is onboarded, or a supplier is breached. A result more than a few months old should be treated as history.
Scores are indicative, not precise. They are built from judgement weights applied to ordinal self-ratings. Treat the band — and the gate failures — as the signal. A difference of a few points between two assessments is not meaningful.
07Recommendations, and your responsibility
Everything this assessment produces is a recommendation.
Implementing our recommendations is intended to reduce the likelihood and impact of an incident. It cannot eliminate either. No control set, and no advisor, can promise prevention.
You remain responsible for deciding what to act on, for how changes are implemented and tested in your environment, and for the consequences of those changes. Where we recommend technical work — hardening, configuration changes, policy enforcement — it should be carried out by someone competent to do it, on a tested basis, with a working restore path available. Some recommended changes can disrupt or break systems if applied without care.
Where work falls outside our scope we will say so and, where appropriate, introduce you to a partner who specialises in it. Those partners are independent businesses, and we do not warrant their work.
08Currency of this statement
This statement applies to Secured Visibility Framework™ v3.1. Our control set, weights and sources change as the threat landscape does; when they change materially we bump the version and say what moved.
Prior reports remain accurate as of their own version and date, and are not directly comparable across versions. If your score moved and you want to know whether that was you or us, ask — we will tell you which.
Questions about any of this?
If something in your report does not match what you know about your own business, that is worth a conversation rather than a shrug. We would rather correct a score than defend one.
Questions about this statement: mike@redefinemedia.ca