Open Standards-Based Cyber Rating

Why Do Vendor Risk Teams Care Whether a Rating Is Open Standards-Based?

A rating built on open standards survives the one question every audit eventually asks. How did you get this number? Proprietary scoring models can be internally consistent and still be impossible to defend, because the vendor being rated, the examiner reviewing the file, and the risk team making the call are all reading a grade none of them can trace to a source. An outside-in assessment run against open standards removes that ambiguity, since every finding sits on a named framework a third party can look up independently, whether that's a regulator, a cyber insurance underwriter, or the vendor itself.

A black-box rating typically hides:

• Which category moved the grade. A vendor sees a number change with no visibility into which of dozens of factors caused it.
• What technical finding caused the shift. Without a named finding, the vendor's security team has nothing specific to remediate.
• Which standard or scoring system was used to weigh it. A grade that can't be recalculated by an outside party isn't a fact, it's an opinion.

In regulated sectors such as financial services, examiners increasingly expect a documented methodology behind every third-party risk finding as part of a broader third-party risk management program, not just a score on a dashboard.

Which Open Standards Actually Feed the Rating?

Four frameworks drive the letter grade: MITRE’s Cyber Threat Susceptibility Assessment, the Common Weakness Risk Analysis Framework, the Common Weakness Scoring System, and the Common Vulnerability Scoring System. Open FAIR™ then translates those findings into financial terms.

• MITRE CTSA defines the assessment scope, the assets, attack techniques, and adversary types a given evaluation considers before any scoring happens.
• CWRAF (Common Weakness Risk Analysis Framework) prioritizes which software weaknesses matter most in a given context, so scoring reflects real-world relevance rather than treating every weakness equally.
• CVSS scores the severity of a specific vulnerability using a published formula any security team can recalculate.
• CWSS ranks the underlying software weakness behind a vulnerability, so two similar-looking flaws don’t get treated identically when their real-world exploitability differs.
• Open FAIR™ sits on top of the rating rather than inside it, translating a technical finding, like an exposed critical port, into a loss-exposure estimate a finance or risk committee can act on.

Open FAIR Turns Findings Into Dollars

Most of the frameworks behind a cyber rating are familiar to a security team. Open FAIR is the one that isn't, and it's arguably the most consequential, because it's the step that converts a critical port exposure into a number a CFO or a board can weigh against other business risk. Without it, an open standards-based rating is still auditable, but it stays a technical document a security team reads alone.

How Is Third-Party Data Verified Before It Feeds Into a Rating?

Every data point is cross-validated against at least two independent sources before it factors into a rating.

Cross-Validation Confirms Every Data Point

A single source, a single scan, a single self-reported answer, can be wrong or stale. Requiring two or more independent sources to agree before a finding counts toward a rating is what keeps a false positive from becoming a vendor's problem to disprove.

Continuous Collection Replaces the Periodic Snapshot

A questionnaire captures a vendor's posture on the day it was answered. An open standards-based rating is built from continuously collected data across a much larger footprint, which is what makes it possible to catch a posture change between a vendor's scheduled reviews rather than at the next one.

• 97% data accuracy, achieved through cross-validation across two or more independent sources.
• 3% false-positive rate and 5% false-negative rate, low enough that a flagged finding is usually worth acting on directly.
• Hundreds of data sources covering 34M+ companies, the scale a continuously observed rating needs to stay current.

Black Kite®'s 2026 Wholesale & Retail Cyber Risk Report found that 68% of critical vendors in those sectors carried an unresolved critical patch management vulnerability. Because each finding traces to a named category, a risk team can point a vendor to the specific issue behind it.

How Does This Differ From Black Kite's Cyber Rating?

A cyber rating is the output; an open standards-based approach is the method that makes the output defensible. Cyber rating covers what the grade looks like day to day, the letter grade a vendor sees, the category breakdown behind it, and how a risk team acts on it. This entry covers the underlying commitment to publicly documented standards that makes that grade something more than an opinion. A rating can exist without being open standards-based; plenty of vendor risk products work that way, which is exactly the distinction this page exists to draw.

How Does an Open Standards-Based Rating Differ From a SIG or SOC 2 Report?

A SIG questionnaire and a SOC 2 report are both standards, but both depend on the vendor to report and an auditor to confirm, on a schedule the vendor controls. The SIG questionnaire collects self-reported answers to a standardized set of security questions, and a SOC 2 report reflects an auditor's opinion of controls over a period the vendor chooses to have reviewed. Both are genuine standards, and both have a place in a due diligence file. An open standards-based rating fills the gap between those point-in-time exercises, since it's observed continuously from outside the vendor's walls using the same published frameworks, without waiting for a form or an audit calendar. An ISO 27001 certification works similarly to SOC 2 in this respect, a periodic, vendor-commissioned audit rather than a continuous, externally observed one. A compliance completeness rating measures something related but distinct, how many recognized controls a vendor's evidence covers, and it still depends on the vendor supplying documentation to check against.

What Happens When a Finding Can't Be Traced to a Published Standard?

Open standards move slower than attackers do, so a genuinely new technique can show up on a vendor's infrastructure before any framework has a name for it. CVSS, CWSS, and CTSA are maintained by community and government bodies that publish updates on their own schedule, not in real time as new attacker tradecraft appears. When a signal doesn't map cleanly to an existing category, the honest options are to hold the finding until it can be classified correctly or to disclose it qualitatively rather than force it into a rating it doesn't fit. Either choice means an open standards-based rating can occasionally lag a genuinely novel threat by roughly the same margin the underlying standards do, which is the tradeoff for a number a team can actually defend later.

How Does Black Kite Apply an Open Standards-Based Rating in Practice?

Black Kite built its entire risk management methodology around this approach, because a rating a vendor can't reproduce or a regulator can't audit doesn't hold up when it matters most. Every category in the platform maps to a named standard, so a risk team can walk a vendor through the exact finding behind a grade change instead of asking them to trust it. That's also why the platform leans on continuous monitoring rather than a periodic scan, since an open standard is only as useful as the data feeding it, and vendor risk doesn't hold still between quarterly reviews.

See also: Cyber Risk in Financial Terms Using Open FAIR