Security Stack Logo

Workspace

Evaluation packs

TL;DRCurated question sets per Domain, anchored to industry-standard security frameworks.

An evaluation pack is the curated question set behind the Requirements Builder for a Domain. It exists so you do not have to invent your own evaluation from a blank page: the pack asks what you are rolling out or protecting, then puts the right questions in front of you as outcomes you can select.

What is inside a pack

  • Control outcomes. Statements of what should be true after you deploy something, written in buyer language. These are what the matching system scores your candidates against.
  • Segments. The pack first asks which situations apply to you, and only the outcomes for those situations appear. You evaluate your problem, not the whole Domain.
  • Context questions. Deployment, operations, and procurement questions that shape your export. They are context for the reader of your brief, not capabilities, so they are not scored.
  • Baseline assurances. The asks every shortlisted vendor should meet regardless of your selections, stamped into every exported brief so they are never forgotten in procurement.

Anchored to industry-standard frameworks

Pack outcomes are distilled from published security frameworks. The live AI Security pack, for example, is anchored to the OWASP LLM Top 10, the NIST AI RMF, and MITRE ATLAS. Anchored means exactly that: each outcome carries the framework controls it addresses, and your export names them, so the brief reads as a defensible evaluation rather than a wishlist.

The export is honest in both directions: it lists the framework controls your selections address and the pack-mapped controls they explicitly do not. Outcomes you write yourself are first-class in the export but are never given a framework anchor: the export only cites framework controls we have verified.

The core layer every brief shares

Underneath every pack sits a universal core: cross-category outcomes and the environment questions about compliance certifications, integrations, and deployment. These appear in every brief, whether or not your Domain has a live pack, so a brief is always more than a bare product list.

Packs are built one Domain at a time. AI Security is live today, with GRC & Compliance and Identity & Access Management next in line. What happens in a Domain without a live pack is described in how matching works.