How SIAS assessments work

Before any testing

1. 01
   Application and scope

   The organization declares the exact scope in a signed form: legal entity, websites, products or systems, environments, locations, data types and domains. It authorizes testing of every asset.

2. 02
   Conflict-of-interest check

   SecurityInspect checks for any relationship that could affect impartiality, including past advisory work. Nothing else starts until this check is clear.

3. 03
   Assets and systems

   The assessment team identifies every asset in scope and compares the declared inventory with what it discovers.

4. 04
   Evidence request

   The team asks for the specific evidence each control requires.

Testing and review

5. 05
   Automated analysis

   Automated technical tests run against the declared assets, and a technical tester confirms or rejects every result that could affect a rating.

6. 06
   Manual technical testing

   Technical testers test what software can’t judge well: access control, business logic, and weaknesses that combine.

7. 07
   Policy and process review

   Assessors check that policies exist and that practice matches them.

8. 08
   Interviews and observation

   Assessors talk to the people who run the controls and watch key processes.

Findings and remediation

9. 09
   Findings

   Each finding gets a severity. The organization can check the report for factual accuracy.

10. 10
    Remediation and retesting

    The organization may fix findings within 90 days of the findings report. SecurityInspect retests each fix. A retest replaces the original result only when the fix is verified.

Review and decision

11. 11
    Independent quality review

    A reviewer who was not on the assessment team reviews the whole file: evidence, severity calls, not-applicable decisions and compensating controls. High-risk judgments need a second independent reviewer.

12. 12
    Certification decision

    A separate decision-maker applies the published checks and records a signed, timestamped decision with reasons.

13. 13
    Certificate and record

    If certification is granted, the certificate, the public verification record and the badge are issued together.

After certification

14. 14
    Surveillance

    A formal surveillance review around month 6 retests critical controls, compensating controls, open exceptions and remediation plans, and anything affected by a reported change. SecurityInspect also runs surveillance checks during the year.

15. 15
    Renewal or status change

    A full reassessment before expiry, or suspension, revocation, withdrawal or expiry when the rules require it.

What software does and what people decide

The software never rates a control, assigns a level or publishes a record. People set every rating and severity, approve compensating controls and exceptions, and make the decision.

On every file, people:

• Decide whether the scope is meaningful and exclusions are acceptable
• Test access control, business logic and chained weaknesses
• Judge whether policies are adequate and actually followed
• Confirm or reject every automated result that affects a rating
• Set every rating and severity, approve compensating controls and exceptions, and make the decision

Evidence you can trust

Every evidence item is hashed (SHA-256) and timestamped in UTC when it is received, and linked to the test that used it. False, altered, misleading or withheld evidence ends the assessment without an outcome.

Assessors keep notes for every procedure. A second person reviews high-risk judgments.

What never leads to certification on its own

Certification is never issued from a vulnerability scan, an automated score, self-attestation, a questionnaire or unvalidated evidence alone.

The checks every certification decision must pass