Skip to content
Quantix Security Labs

Assurance framework

How Quantix runs its own work: who may review what, how findings are checked, how client code and evidence are protected, and how readers can trust a report. Each control domain is aligned with the standards described on the Security Standards page.

Aligned with ISO/IEC 27001, SOC 2 TSC, NIST CSF 2.0. Not certified, attested or independently audited.

control domains
9
controls
29
engagement stages
6
alignment references
25
Isometric illustration of independent review: two lenses examine the same finding from opposite sides beside a sealed report and its evidence trail.

Purpose

Three questions every engagement must answer.

The framework exists so that a client, an auditor or a reader of a published report can answer these with evidence rather than trust.

Control domains

Controls across the engagement.

Each domain states its objective, the controls that meet it, the evidence kept, and the standard references it is aligned with. Select a stage to see which domains apply at that point.
Which assurance control domains apply at each stage of an engagement. Use the stage buttons to filter the domain list below.
Control domain
QA-INDIndependence and objectivityAppliesAppliesNot applicableAppliesNot applicableNot applicable
QA-REVPeer review and qualityNot applicableAppliesAppliesAppliesNot applicableNot applicable
QA-CODSecure handling of client code and dataAppliesAppliesAppliesNot applicableNot applicableApplies
QA-EVIEvidence retentionNot applicableAppliesAppliesAppliesNot applicableApplies
QA-TOOLTooling integrityNot applicableAppliesAppliesNot applicableNot applicableNot applicable
QA-DOCReport integrity and signing keysNot applicableNot applicableNot applicableAppliesAppliesNot applicable
QA-PUBConfidentiality and coordinated publicationNot applicableNot applicableNot applicableAppliesAppliesNot applicable
QA-INCIncident handlingAppliesAppliesAppliesAppliesAppliesApplies
QA-PEOCompetence and trainingAppliesAppliesNot applicableNot applicableNot applicableNot applicable

All 9 control domains

  1. QA-IND

    Independence and objectivity

    Findings and severities reflect the evidence, not the commercial relationship.

    Stages: Scoping · Review · Reporting

    Controls

    • Reviewers do not assess code they helped design or write; prior advisory work on the same system is disclosed in the report.
    • Severity ratings follow the published rubric and are not negotiated; client disagreement is recorded beside the finding.
    • Conflicts of interest are declared before staffing and kept in a register.

    Evidence kept

    • Staffing and conflict declarations
    • Severity change log with rationale

    Aligned with

  2. QA-REV

    Peer review and quality

    Every reported finding is reproduced or rigorously argued and checked by a second reviewer.

    Stages: Review · Validation · Reporting

    Controls

    • Two reviewers cover each critical component independently.
    • A second reviewer verifies every finding, its severity and its recommendation before release.
    • Reports pass a quality checklist covering scope, commit references, limitations and mappings.
    • Severity calibration sessions compare ratings across engagements.

    Evidence kept

    • Review assignments
    • Finding verification sign-off
    • Report QA checklist

    Aligned with

  3. QA-COD

    Secure handling of client code and data

    Client source code, credentials and findings are accessible only to the people who need them.

    Stages: Scoping · Review · Validation · Retention

    Controls

    • Repository access is read-only, scoped to the engagement and revoked at completion.
    • Review takes place in isolated, encrypted workspaces; client code is not uploaded to external services without written consent.
    • Unpublished findings are shared only through access-controlled channels.
    • Client material is deleted or returned at the end of the retention period set in the engagement agreement.

    Evidence kept

    • Access grant and revocation records
    • Workspace inventory
    • Deletion confirmations

    Aligned with

  4. QA-EVI

    Evidence retention

    Every conclusion in a report can be traced to retained evidence.

    Stages: Review · Validation · Reporting · Retention

    Controls

    • Working papers, proof-of-concept tests and tool outputs are stored per engagement with the commit references they apply to.
    • Evidence stores are append-only during an engagement and access-logged.
    • Retention periods follow the engagement agreement and are reviewed when it ends.

    Evidence kept

    • Evidence index per engagement
    • Storage access logs

    Aligned with

  5. QA-TOOL

    Tooling integrity

    The tools that produce findings are known, versioned and trustworthy.

    Stages: Review · Validation

    Controls

    • Analysis tools and their versions are pinned per engagement and recorded in the report appendix.
    • Tools are installed from verified sources with checksums; custom detectors are code-reviewed.
    • Review environments are rebuilt from known images rather than reused between clients.

    Evidence kept

    • Tool version manifests
    • Environment build records

    Aligned with

  6. QA-DOC

    Report integrity and signing keys

    Readers can confirm which document they hold and that it has not been altered.

    Stages: Reporting · Publication

    Controls

    • Each report carries a unique document identifier and version; superseded versions are marked.
    • A digest of every final document is recorded at publication.
    • Where reports are cryptographically signed, signing keys are held on hardware devices with named custodians and rotated on staff changes.

    Evidence kept

    • Document register with digests
    • Key custody records

    Aligned with

  7. QA-PUB

    Confidentiality and coordinated publication

    Nothing is published without the client’s decision, and third-party issues are disclosed responsibly.

    Stages: Reporting · Publication

    Controls

    • Reports are published only with client approval and after critical issues are resolved or mitigated.
    • Vulnerabilities found in third-party code are reported to the maintainer through coordinated disclosure.
    • Research publications credit original discoverers and never attribute others’ work to Quantix.

    Evidence kept

    • Publication approvals
    • Disclosure correspondence log

    Aligned with

  8. QA-INC

    Incident handling

    Incidents affecting Quantix or client material are contained, reported and learned from.

    Stages: Scoping · Review · Validation · Reporting · Publication · Retention

    Controls

    • A runbook covers loss of client code, compromised accounts and erroneous publication.
    • Affected clients are notified without undue delay once an incident affecting their material is confirmed.
    • Every incident ends with a written review and tracked improvements.

    Evidence kept

    • Incident register
    • Post-incident reviews

    Aligned with

  9. QA-PEO

    Competence and training

    Reviewers have current, proven knowledge of the systems they assess.

    Stages: Scoping · Review

    Controls

    • Reviewers are assigned only to ecosystems in which they have prior review experience.
    • Research time outside client work is used to study new vulnerability classes and tooling.
    • New reviewers shadow engagements before leading components.

    Evidence kept

    • Skills matrix
    • Training and research records

    Aligned with

Lifecycle

Six stages, each with its own controls.

  1. 01

    Scoping

    Scope, conflicts and access are agreed before any code is shared.

    4 domains apply

  2. 02

    Review

    Reviewers work in isolated environments with pinned tools.

    7 domains apply

  3. 03

    Validation

    Every finding is reproduced or argued and checked by a second reviewer.

    5 domains apply

  4. 04

    Reporting

    Severity, wording and mappings pass quality review; the document is registered.

    6 domains apply

  5. 05

    Publication

    Nothing is published without the client’s decision and coordinated disclosure.

    3 domains apply

  6. 06

    Retention

    Evidence is kept for the agreed period, then deleted or returned.

    3 domains apply

Alignment

Where each domain meets a standard.

Alignment means the control was designed with the referenced clause, criterion or category in mind. It is not a claim of certification or attestation against it.
Standard references each assurance domain is aligned with
StandardReference → assurance domain
ISO/IEC 27001
  • A.5.3 Segregation of dutiesQA-INDIndependence and objectivity
  • Clause 9 Performance evaluationQA-REVPeer review and quality
  • A.8.4 Access to source codeQA-CODSecure handling of client code and data
  • A.5.15 Access controlQA-CODSecure handling of client code and data
  • A.5.28 Collection of evidenceQA-EVIEvidence retention
  • A.5.33 Protection of recordsQA-EVIEvidence retention
  • A.5.21 ICT supply chainQA-TOOLTooling integrity
  • A.8.32 Change managementQA-TOOLTooling integrity
  • A.8.24 Use of cryptographyQA-DOCReport integrity and signing keys
  • A.5.14 Information transferQA-PUBConfidentiality and coordinated publication
  • A.5.24–A.5.27 Incident managementQA-INCIncident handling
  • A.6.3 Awareness, education and trainingQA-PEOCompetence and training
SOC 2 TSC
  • CC1 Control environmentQA-INDIndependence and objectivity
  • CC4 Monitoring activitiesQA-REVPeer review and quality
  • CC6.1 Logical accessQA-CODSecure handling of client code and data
  • CC2 Communication and informationQA-EVIEvidence retention
  • CC7.3–CC7.4 Security events and incidentsQA-INCIncident handling
NIST CSF 2.0
  • GV.RR Roles, responsibilities and authoritiesQA-INDIndependence and objectivity
  • ID.IM ImprovementQA-REVPeer review and quality
  • PR.DS Data securityQA-CODSecure handling of client code and data
  • GV.SC Supply chain risk managementQA-TOOLTooling integrity
  • PR.DS Data securityQA-DOCReport integrity and signing keys
  • RS.CO Incident response reporting and communicationQA-PUBConfidentiality and coordinated publication
  • RS.MA Incident managementQA-INCIncident handling
  • PR.AT Awareness and trainingQA-PEOCompetence and training

What this framework is, and is not.

It is a description of the controls Quantix applies to its own work, published so that clients and readers can evaluate them before relying on a report.

It is not a certification, an attestation or the result of an independent audit. Quantix does not claim ISO/IEC 27001 certification or a SOC 2 report. Where a client needs evidence that a control operated during their engagement, it is provided under that engagement’s confidentiality terms.

The scale Quantix uses to rate the systems it assesses is a separate thing, described with the maturity model. How this website itself handles data is set out on the Trust & Security page.

Ask how a control works in practice.

If your procurement or audit team needs to understand how Quantix handles code, evidence or publication, ask before the engagement starts.

Contact QuantixSecurity standards