Scoring
The book
A commissioner records an incident against a claimed company. The saved score is the rule’s points times that company’s multiplier. Later edits to this catalog do not rewrite a week that is already on the board. Ties break on transparency events, then on fewer negative incidents.
| Rule | Points | What it means |
|---|---|---|
Public postmortem with a timeline and what changed. public_postmortem · transparency · positive | +10 | Breaks ties. |
Material incident disclosed within 72 hours. timely_disclosure · transparency · positive | +8 | Breaks ties. |
A known critical issue was patched inside the stated window. critical_patched_in_sla · positive | +8 | |
An independent review was published. independent_audit_published · transparency · positive | +7 | Breaks ties. |
Affected customers were notified directly. customer_notice · transparency · positive | +6 | Breaks ties. |
A researcher was paid for a real report. bug_bounty_paid · positive | +5 | |
A customer-facing outage lasted more than 24 hours. multi_day_outage · negative | -8 | |
A known critical vulnerability stayed open past the window. known_critical_unpatched · negative | -9 | |
A regulator assessed a fine for a security or privacy failure. regulatory_fine · negative | -10 | |
Confirmed unauthorized access to customer or corporate data. confirmed_breach · negative | -12 | |
Stolen data was offered or published outside the company. stolen_data_circulating · negative | -14 | |
Ransomware interrupted operations or data. ransomware_event · negative | -18 | |
The company knew and kept a material incident from the people affected. concealed_incident · negative | -20 |