Method · Edition v2.1 · effective 30 July 2026

Four factors. Every one computed from evidence this platform holds.

We removed two factors from Edition v1.1: a sector base rate we could not compute without a customer population we do not yet have, and a threat-load factor that measured the world rather than your evidence. The first is withdrawn until it is real. The second became Outlook.

We are telling you this because a methodology you cannot audit is a marketing document with numbers in it.

What the number is

The Bawin Index is not a rating. It is an index of the evidence you have chosen to connect, scored against the clauses that ask for it. It is comparable to your own last reading, not to another company's. Anyone who tells you their compliance number is comparable across companies is selling you a curve they cannot show you.

§01 Factors and weights

Factor	Weight	What it measures
Evidence freshness	40%	How recently each control was independently verified from a connected source. Decay on a defined half-life per control class.
Control coverage	35%	Share of the in-scope control set with any verified evidence. Uncovered controls score zero, not neutral.
Drift	15%	Signed rate of change over the trailing 30 days. Rapid negative drift is penalised even at a high absolute reading.
Challenge resolution	10%	Of the challenges Bawin has raised against your evidence, how many you have answered, and how quickly.
Total	100%

90–100	Audit-ready	Evidence current and complete; minimal drift; challenges answered.
75–89	Minor gaps	A small number of controls need refresh.
55–74	Material gaps	Coverage or freshness gaps likely to surface at audit.
0–54	Not audit-ready	Significant gaps, stale evidence, or high volatility.

Bands describe evidence posture, not legal compliance status.

BWNv2.1UK/EU2026-07-30

MakerMethodologyResidencyEvidence

§02 What Edition v2.1 removed, and why

Sector base rate
was 5% · withdrawn
It compares you against a peer-sector population. We have no customer population, so there is no base rate to compute. A weight computed from data that does not exist is a fabricated input. Withdrawn until it is real.
Threat load
was 15% · withdrawn
It measures the world, not your evidence. Two organisations with identical evidence would read differently for reasons neither controls. Defensible in a forecast, indefensible in an index. It became Outlook.

§03 Index and Outlook, always a pair

Index

—

What you can evidence today.

Outlook

—

What is coming that you cannot yet evidence.

ImprovingFewer open Signal items map to controls with no current evidence than 30 days ago.
StableNo material change in threat load, regulatory stage or unevidenced Signal exposure.
DeterioratingThreat load, a regulatory stage change from primary source, or a rising count of Signal items landing on unevidenced controls.

Outlook is never a number and is never averaged into the index. We publish these separately because combining them would let a quiet month flatter a weak evidence base. Ratings agencies separate rating from outlook for the same reason.

§04 The control spine

Bawin does not build framework mappings one at a time. It maintains one canonical, versioned control catalogue — the spine — and treats every framework as a projection of it. One evidence item resolves to a spine control, and that control resolves to every clause, in every framework, that asks for it. Adding a framework is a crosswalk, not a rebuild, and it does not alter any existing reading.

Spine edition v1.0 · Crosswalk edition v1.0 · Reviewed 2026-07-28

Relationship and confidence

Every published mapping states its relationship — equivalent, subset, superset or intersects — and its confidence: authoritative (published by the issuing body or a formal crosswalk programme), derived (inherited through an intermediate mapping), or Bawin review (our own analysis, with a named reviewer and date). A mapping without those fields is an assertion. With them, it is checkable.

Sourcing

The public-facing structure is NIST CSF 2.0, resolved against NIST SP 800-53 Rev 5 in OSCAL where sub-categories are too coarse. Crosswalks start from the NIST OLIR programme. We state its limits plainly: NIST performs only limited conformance testing on submitted references, does not correctness-test non-NIST mappings, and listing in the catalogue is not endorsement. OLIR is therefore a substrate, not a conclusion — every mapping carries our own review status on top of it. UK regimes (CAF, Cyber Essentials, DSPT, GovAssure) are Crown-copyright or OGL and are mapped directly. We do not build on any catalogue whose licence prohibits derivative works.

See the coverage matrix →

§05 Independence

Independence is a methodological commitment, not a marketing claim, so it is documented here alongside the arithmetic rather than on a page of its own. Bawin observes cloud and security platforms it does not resell and from which it takes no compensation. No reading, coverage decision or Signal item may be purchased, accelerated, suppressed or influenced by payment, and commercial tier does not affect methodology. Methodology changes are reviewed explicitly against the test of whether they privilege any single vendor or platform, and that review is published with the change. The full commitments are in the public company policy.

§06 What we will not sell you

Each of these is a revenue line elsewhere in this category. Each would destroy the only thing that makes an assessment worth reading.

—Policy and document generation.
—Remediation work, managed services, or a virtual CISO.
—Audit preparation, or any 'audit success' guarantee.
—Auditor referral fees, marketplace commissions, or revenue share.
—Bundled penetration testing.
—Resale of any tool the platform assesses.
—Paid placement, or paid improvement of any reading.
—Certification of any kind.

§07 Declared interests

The register of material interests of Bawin's officers that could reasonably be perceived to affect the independence of an assessment. Perceived conflicts are treated as conflicts: the test is what a reasonable, informed third party would conclude.

Officer: The sole director of Bawin Limited
Organisation: British Standards Institution · certification body
Role: auditing role covering management system schemes including ISO/IEC 27001
Conflict: Bawin Limited operates a product that scores evidence against ISO/IEC 27001 among other regimes. A reasonable, informed third party would regard that as a conflict, and Bawin treats it as one.

Controls in force

—Standing recusal. That officer takes no part in any reading, crosswalk, coverage decision or Signal item concerning any organisation they have assessed, are assessing, or may be assigned to assess. Each application is logged individually in the trust log.
—No cross-issuance. No Bawin reading is issued to any organisation within that officer’s assessment portfolio.
—No influence on method. Weightings, the control spine and published crosswalks concerning ISO/IEC 27001 are reviewed against the test at §05 before publication, and that review is published with the change.
—No consideration. Neither Bawin nor its officers receive any consideration from the British Standards Institution in respect of Bawin, and the British Standards Institution holds no interest in Bawin Limited.

OPEN ITEM 01

Written confirmation of this arrangement from the certification body’s impartiality function, naming the ISO/IEC 27001 scoring feature specifically, is being sought. It is not yet held. It will be published here with its date when it is, and is disclosed as outstanding until then. Bawin declares an unresolved clearance rather than omit the interest.

No officer holds equity in, or receives any consideration from, any organisation Bawin reads or any vendor Bawin observes.

Recusals in force: 2026-08-12
Instances recorded: 0 · No live readings have been issued under any method edition to date.
Register reviewed: 2026-08-12
Review cadence: At least quarterly and on every change of officer role.

§08 What the index cannot tell you

Stated once, here, at full strength. These are the only limits disclosure on the site, and they are load-bearing.

It is not a rating.
The reading is computed from evidence you chose to connect. That is selection by design, and it means your number is comparable to your own last reading and to nothing else.
It is not a certification.
Certification decisions remain with your accredited body — UKAS, IASME, QSA, notified body, licensed CPA firm. The index runs alongside a certification audit; it does not replace one.
It is not an audit opinion.
Bawin maps evidence to clauses. Only an auditor issues an opinion on that evidence. That distinction is legally and commercially load-bearing.
It is not consulting.
We do not perform remediation, write policies, prepare you for audit, sell tools, or take referral fees.
It is not a substitute for legal advice.
Risk-tier determinations, breach-notification decisions and interpretive calls belong with your general counsel or DPO.
It is not a portfolio average.
Readings at unequal scope cannot be averaged.

§09 Challenging a reading

Any customer may request the complete underlying evidence breakdown for their own reading at any time, at no charge. Any reader may write to contact@bawin.co with a methodology objection. Substantive objections and their resolution are logged in the trust log, including where the objection is upheld against us.

§10 Editions and archives

Edition v2.0 — withdrawn 2026-07-30Read the archived edition

Withdrawn when v2.1 added comparability, overlap and Ledger arithmetic.

Edition v1.1 — withdrawn 2026-07-28Read the archived edition

Sector base rate and threat load withdrawn.

Edition v1.0 — withdrawn 2026-07-22Read the archived edition

First published edition.

§11 Comparability — when two readings may be set side by side

A reading is comparable to another only when both were computed under the same methodology edition, against the same mandated scope, from connectors of the same class, over the same observation window. Where any of those four differ, the readings are stated separately and never averaged, ranked or summed. A portfolio view that mixes them is a list, not an index.

—Same methodology edition — a score computed under an earlier edition is shown with that edition's label and is not restated.
—Same mandated scope — the connector set and entity boundary must match, or the difference is disclosed on the reading.
—Same connector class — an asserted source and a measured source do not produce comparable freshness.
—Same window — trailing twelve months in both cases, aligned to the same period end.

Where a company falls outside the mandated scope, no reading is computed and the state renders as an em dash. A missing reading is never rendered as a low one.

§12 Overlap arithmetic

Overlap is the share of a framework's clauses already answered by evidence held for another framework. It is computed from the spine, not from framework text: two clauses overlap when both resolve to the same spine control and that control holds current evidence.

overlap(A, B) = | current(spine(A)) ∩ current(spine(B)) | ÷ | spine(B) |

Overlap is directional and is stated as such: the share of B answered by A is not the share of A answered by B. Overlap counts only controls whose evidence is current against its own half-life. A clause mapped with an intersects relationship contributes to overlap only where the mapping's confidence is authoritative or Bawin review; derived intersections are excluded and counted as uncovered.

Overlap reduces work. It never raises a reading: an overlapping clause is still evidenced or not evidenced on its own terms, and no framework inherits a score from another.

§13 The Ledger — money arithmetic

The Ledger converts control state into currency. It is a separate reading from the index and never feeds it: no figure in the Ledger moves a score, and no score is derived from a figure. Every Ledger output carries a MODELLED chip and exposes its inputs, because the constants are supplied by the reader, not by us.

Cost to close

Σ (open control × estimated hours × blended day rate ÷ 8) + named tooling and audit fees

Hours are measured against the evidence actually present, not against a generic control count. The day rate is yours.

Revenue gated

Σ (deal value × probability) where the deal is recorded as blocked or delayed at security review

Only deals the reader marks as gated are counted. Nothing is inferred from pipeline size.

Recurring drag

(FTE × blended cost × share of time on manual evidence) + duplicated audit and questionnaire effort

Retained headcount recognises nothing. A cost that stays on the P&L is not a saving.

Value at exit

EBITDA delta × exit multiple, stated as a range

Multiple turns are protected, not created. Posture rarely lifts a price; it stops being a blocker. Never added to the EBITDA figures above.

EBITDA effects, cash-timing effects and enterprise-value effects are three separate objects and are never summed into one another. See the Ledger.

Generated from scoring configuration v2.1 on 2026-07-30. The weights above are the weights the product applies. They are not a description of them.