The declaration is the first artefact of the engagement and the one most people are surprised to find. It is signed before any measurement takes place, and its order in the sequence is not negotiable.
Why it exists
An assessor working alone can determine whether a control functions. What an assessor cannot determine is whether an absent control is a deficiency or a decision. A firewall policy that accepts all inbound traffic on an interface is a serious finding — unless the filtering is performed upstream by design, in which case it is architecture, and reporting it as a fault is noise dressed as rigour.
We learned this on our own infrastructure. In the first full run of the method against ourselves, two findings out of thirty-one were of exactly this kind: technically accurate, and wrong. Roughly six per cent of the report was an assessor mistaking a decision for a defect. The declaration exists because that rate is not acceptable in a document someone signs.
What it contains
- Perimeter
- What is exposed to the public internet, and what is deliberately closed.
- Logging
- What is recorded, and the destination each record is expected to reach.
- Continuity
- What is backed up, how far back it goes, and where the copies live.
- Access
- Who holds administrative credentials, and by which mechanism.
- Operational timezone
- The clock against which every timestamp in the report will be normalised.
It is written in your words, not ours. We can help you phrase it, but we do not write it for you — an assessor who drafts the claims and then grades them has quietly become the author of both sides of the exercise.
How it shapes the report
Every verdict in the Verification Report is filed under one of two sections. Section A holds claims you declared, tested against evidence. Section B holds findings that fall outside the declaration — things we encountered that you had not claimed either way.
The distinction matters when the report is read by someone who was not in the room. A failure in Section A is a stated control that does not hold, and that is the finding with consequences. A finding in Section B is information, offered without accusation, because you never claimed otherwise.
It is also the questionnaire
The declaration and an insurer’s renewal questionnaire ask, in different words, the same set of questions. If a questionnaire is already on your desk, it can serve as the declaration directly. That is not a coincidence of format — it is the reason the service is shaped this way.