How we work
This is the standard the firm releases software against. It is published in full because the standard is the proof: a firm that sells release audits should be able to show the ruler. The standard is free. What we sell is applying it independently.
The checklist has 32 checklist sections, seven of which block a release. A blocking section that fails stops the release regardless of everything else. The remaining sections inform the GO/NO-GO decision.
Findings are graded S1 to S4, with evidence for each. S1 and S2 findings are closed, or formally waived with a named owner and a date, before a GO is recorded.
Every pass ends in a GO or NO-GO recommendation with the exact gating list: the items that must be closed before release. A GO is recorded with a named signatory. There is no partial GO.
On every subsequent pass, every previously fixed item and every security control is re-verified. A fix that has not been re-tested is a hope, not a fix. A finding whose premise proves wrong is formally withdrawn, and the withdrawal is recorded.
The redacted example from a real audit will be published with the client-safe version of the standard. The table has these columns.
| Finding | Severity | Evidence | Fix | Verified by | Verified on | Regression re-test |
|---|---|---|---|---|---|---|
| — | — | — | — | — | — | — |
The firm has run seven numbered QA passes on a single product, each with fix verification and regression re-testing.