Correctness Board

How correct the engine is, framework by framework, measured on sealed test sets and dated. As of 2026-10-14. This is the only page on this site that states a correctness figure; every figure names the run that produced it.

How to read it

A sealed test set is a set of evidence-and-control pairs that were ruled on (by the owner, or by an AI assessor whose rulings the owner adopted) and then held out of all training. A sealed run measures the engine's AI credits on that set once. The measured floor is the one-sided 95% lower bound on the share of credits shown that were right. AI credits switch on for a framework only after a sealed run with zero wrong in at least 20 shown; auditor-grade needs zero wrong in at least 59; 98% proven needs zero wrong in at least 150. Until then the framework shows candidate evidence for assessor review, never a credit.

58frameworks on the engine

14with a sealed test set

4with a sealed run taken

1with AI credits on

0auditor-grade or 98% proven

Frameworks with a sealed test set

Framework	Sealed test set and who ruled it	Measured floor (95%), latest sealed run	Credits shown	Wrong	AI credits	What it needs next
NIST Cybersecurity Framework 2.0	198 pairs (116 supports, 82 false credits) · owner-ruled 104 · AI-assessed (owner-adopted) 94	87.8% run 36404161883	23	0	On (demo workspace)	On in the demo workspace. Auditor-grade needs zero wrong in at least 59 shown; 98% proven needs 150.
SOC 2 Trust Services Criteria	197 pairs (123 supports, 74 false credits) · owner-ruled 109 · AI-assessed (owner-adopted) 88	80.7% run 36404161883	14	0	Off	Last sealed run: 0 wrong in 14 shown. Switching on needs zero wrong in at least 20 shown.
Essential Eight	370 pairs (212 supports, 158 false credits) · owner-ruled 288 · AI-assessed (owner-adopted) 82	85.6% run 36701165439	70	5	Withdrawn	Withdrawn after 5 wrong in 70 shown. Assessor review until a new sealed run shows zero wrong.
Information Security Manual / IRAP	288 pairs (184 supports, 104 false credits) · owner-ruled 189 · AI-assessed (owner-adopted) 99 27 pairs held out: ASD's September 2026 ISM changed these controls' text; the pairs stay out of measurement until re-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
APRA CPS 234 Information Security	185 pairs (87 supports, 98 false credits) · owner-ruled 110 · AI-assessed (owner-adopted) 75	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
APRA CPS 230 Operational Risk Management	189 pairs (119 supports, 70 false credits) · owner-ruled 101 · AI-assessed (owner-adopted) 88	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
ISO/IEC 27001	213 pairs (116 supports, 97 false credits) · owner-ruled 127 · AI-assessed (owner-adopted) 86	0.0% run 36404161883	1	1	Off	Last sealed run: 1 wrong in 1 shown. Switching on needs zero wrong in at least 20 shown.
SOCI Critical Infrastructure Risk Management Program Rules (LIN 23/006) 2023	60 pairs (49 supports, 11 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
Australian Privacy Principles (Privacy Act 1988, Schedule 1)	71 pairs (38 supports, 33 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
PCI DSS v4.0.1	59 pairs (33 supports, 26 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
CyberSentien IEC 62443-3-2-aligned OT Risk Assessment (engine-authored control set)	21 pairs (1 supports, 20 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
CyberSentien IEC 62443-3-3-aligned OT System Security Assessment (engine-authored control set)	24 pairs (5 supports, 19 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
CyberSentien IEC 62443-4-2-aligned OT Component Security Assessment (engine-authored control set)	22 pairs (2 supports, 20 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.
CyberSentien CLC/TS 50701-aligned Railway Cybersecurity Assessment (engine-authored control set)	27 pairs (3 supports, 24 false credits) · owner-ruled	Not yet measured	—	—	Off	Sealed set built; sealed run not yet taken.

Not yet measured

No sealed test set yet. On these, every document reading is candidate evidence for assessor review.

Protective Security Policy Framework (Release 2026), Consumer Data Right — CDR Rules, Schedule 2, Right Fit For Risk cyber security accreditation (DEWR), Australian Schools Assurance, Australian Early Childhood Education and Care, SMB1001:2026 Readiness, APRA CPS 220 Risk Management, Australian Breach Reporting, ISO/IEC 42001, NIST SP 800-53 Rev 5, FedRAMP Rev 5, CIS Controls v8, SOC 1, SOC 3, HITRUST CSF Readiness, Third-Party Risk Management, CyberSentien secure software development lifecycle gates, Fraud Detection and AML Assurance, CyberSentien AI Governance Assurance, Australia's AI Ethics Principles, Policy for the Responsible Use of AI in Government, National Framework for Assurance of AI in Government, NSW AI Assessment Framework, NSW Generative AI and AI Agent Guidance, Queensland FAIRA Framework, Tasmanian Government AI Guidance, NIST AI Risk Management Framework, NIST AI 600-1 Generative AI Profile, CyberSentien ISO/IEC 27017-aligned assessment (engine-authored control set), CyberSentien ISO/IEC 27018-aligned assessment (engine-authored control set), CyberSentien ISO/IEC 27034-aligned assessment (engine-authored control set), CyberSentien ISO/IEC 27036-aligned assessment (engine-authored control set), CyberSentien CISSP-aligned eight-domain advisory capability, Environmental and Sustainability Readiness, European Union AI Act, OECD AI Principles, UNESCO Recommendation on the Ethics of AI, United Nations General Assembly Resolution 78/265, UAE AI Ethics Guide, India AI Governance Guidelines, US OMB M-25-21, US OMB M-25-22, National Consumer Credit Protection Act 2009 — credit licensee and credit assistance obligations, National Consumer Credit Protection Act 2009 — Part 3-5A mortgage broker best interests duty and conflicted remuneration

Documents that prove nothing

Every release is calibrated on seven deliberately irrelevant documents. Credits shown from them: 0 (calibration run 38300764212, release-20261012-4 (baseline b7e6eae92ff5), which measured every framework registered at the time: 56).

Rulings are by the owner, or by an AI assessor working blind whose rulings the owner adopted; each row says which. This is consistency with those rulings, not an independent audit.