IT Security ArchitectDESIGN REVIEW · THREAT MODEL · TRACE

Editorial policy

How we decide what to publish, how we label it, and how we fix mistakes.

Updated

Sources

We use the most authoritative source for each kind of claim: NIST publications and machine-readable data for controls and frameworks; the issuing body's own pages for certification requirements; the Bureau of Labor Statistics for wages; the original publication for methods such as STRIDE. We avoid citing vendor or affiliate pages as evidence for facts.

Evidence labels

Each reference in a guide shows its type and how we checked it:

  • Type: official standard or dataset, official documentation, issuer documentation, practitioner article, or community document.
  • Checked: dataset (we processed the data ourselves), full text (we read the whole document), or page (we read the cited web page). We say which, and the date.

Facts, inference and judgment

  • Facts are attributed to a source or computed from published data by our build scripts.
  • Inferences drawn from data are labeled as ours.
  • Editorial judgment (which questions to ask, which controls to suggest) is labeled in every tool and guide where it appears.

Data processing

NIST data is downloaded and transformed by a script kept with the site's source. The build stops if a page cites an SP 800-53 control that does not exist or has been withdrawn. Counts shown on the site are computed from the data at build time, not typed by hand.

Updates and corrections

  • A page's "Updated" date changes only for substantive edits: corrected facts, new sections, refreshed data. Typo fixes and layout changes do not change it.
  • Each guide has a revision table listing substantive changes.
  • When NIST publishes new data releases, we rebuild the data and note material changes.
  • To report an error, email info@itsecurityarchitect.com. Confirmed errors are corrected and recorded in the page's revisions.

Review limits

Guides are written and checked by the publisher. They are not reviewed by an independent expert panel, and we do not test products. Content that would need qualified professional review to be safe to rely on is not published.

Independence and money

No one pays for coverage. There are currently no ads or affiliate links. If we add affiliate links, they will be disclosed on the pages that contain them, and we will never accept sponsored placements.