Scope
Describe the system or service context that shapes risk.
Methodology
Explainable assessment from scope to reassessment
Follow the route from declared context and submitted answers to a reported position, practical follow-up and compatible reassessment.
Evidence, uncertainty and accountable judgement remain visible; an answer-based result is not independent assurance.
Declare context
Route relevant controls
Preserve uncertainty
Interpret and report
Reassess compatibly
Assessment flow
Six connected stages
Each stage constrains the next, helping prevent irrelevant questions, disconnected findings, and generic remediation.
Route
Apply inclusion and dependency logic to relevant controls.
Answer and save
Use guided response choices, preserve progress, and record what remains unknown.
Interpret and report
Generate an interim or completed position using the available answer basis.
Resolve and act
Complete outstanding items and direct treatment, ownership, and evidence follow-up.
Reassess and compare
Refresh a compatible answer basis and understand directional change.
Risk semantics
The same answer can have different meaning in different domains
Aegis101 does not collapse Security, Operability, and framework interpretation into one universal label.
Residual security risk
Combines the submitted control position with relevant context to interpret material security weakness and treatment priority. Impact is not exposed as a separate visible score.
Service consequence
Interprets supportability and resilience weaknesses using the service context. Consequence is described qualitatively, not published as raw scoring.
Framework-specific direction
Uses governed mappings and the selected framework's concepts. A mapped indication remains distinct from a formal outcome or compliance judgement.
Governed method
How the assessment position is formed
Every saved report retains the governed question set and method basis used to interpret its confirmed answers. Reports explain the applicable scope, exclusions, uncertainty, material exceptions and result bands so the assessment position can be understood and reviewed.
Security
Active, applicable Security answers inform the residual-risk position. Missing or unresolved information is treated conservatively, while valid governed exclusions are omitted. Material weaknesses can lead the report even where the broader profile is lower.
Operability
Active, applicable Operability answers are interpreted through their governed materiality and the declared service context. Residual control risk remains separate from qualitative service consequence, and neither is presented as evidence of readiness.
Interpretation
Reports show the resulting position, included and excluded scope, material exceptions and assurance limitations. This gives users a clear basis for review, prioritisation and accountable follow-up.
Dynamic routing
Ask what is relevant, and respect dependencies
Scope facts determine which controls are applicable. Within a category, dependency logic avoids asking detailed capability questions before a prerequisite capability exists.
- Applicability: context can include or exclude question groups.
- Prerequisites: later questions are held back when a foundational control is absent.
- Saved-report integrity: the report preserves the confirmed answer basis from the assessment route.
- Transparent counts: confirmed, deferred, and unconfirmed responses are not treated as interchangeable.
Example
Disaster recovery
If no disaster recovery capability is identified, the immediate finding concerns establishing that capability. Detailed questions about its testing and operation should not generate separate findings until the prerequisite exists.
Incomplete information
Use what is known without turning uncertainty into assurance
Aegis101 preserves the difference between a confirmed response and information that is unavailable, deliberately deferred, missing, or internally inconsistent.
Unknown stays unknown
Not-yet-confirmed and unanswered items remain outstanding. They cannot silently improve the reported position.
Interim means interim
Where a valid partial basis supports interpretation, the report uses confirmed answers while disclosing the outstanding population and its effect on reliance.
Conflicts are resolved first
Material scope inconsistencies that prevent reliable routing or interpretation must be reviewed before progression.
Evidence and confidence
Answers create a position; evidence strengthens confidence
Aegis101 identifies where validation would materially improve confidence. It does not claim that documents, tests, or operating records have been independently reviewed simply because an answer was submitted.
Answer completeness
Shows whether the routed assessment has a confirmed response basis.
Evidence priority
Directs attention to records, tests, approvals, monitoring, and closure evidence.
Assurance boundary
States what remains answer-based, unvalidated, accepted, or subject to accountable judgement.
Reassessment and movement
Retain history and compare like with like
Signed-in users can return to records they are authorised to access, maintain notes, rerun eligible assessments, compare compatible completed reports, and export interactive HTML. Trend tooling is planned and is not currently enabled. These access boundaries do not turn submitted answers into independently verified performance.
Authorised history
Record owners and same-portfolio members can open and continue assessments and reports they are authorised to access.
Governed follow-through
Authorised users can rerun eligible assessments, compare compatible completed reports and export self-contained Interactive HTML using the governed assessment basis. PDF report export is temporarily unavailable while its document presentation is refined; permanent deletion remains administrative.
Trend status
Assessment history supports review now; dedicated trend tooling remains visibly planned rather than advertised as an enabled action.
What the output does not do
Clear limitations protect the value of the result
Aegis101 does not provide audit, certification, accreditation, formal compliance approval, formal CAF achievement judgements, or production readiness approval. A favourable answer-based position does not eliminate risk.
Review the outputs in context
The guided report tours show how Core risk reporting and framework-specific interpretation connect methodology, risk language, action planning, and assurance boundaries.