The VendorQuals Verification Standard
A firm’s fee buys a verification pass, so the rubric has to be public: what is checked, how, and what it costs a firm to claim something we cannot verify. This page is the rubric. Every criterion carries its current status, and components we do not run yet say so plainly, because a standard that overstates its own scope is worth nothing.
VendorQuals sells no incident response services. The platform verifies and documents, it does not respond, and every listed firm competes for buyers without the platform holding a side in the competition.
The status vocabulary a listing can carry
Verification is graded, never binary, and the grades are mechanical: a scoring engine aggregates evidence against calibrated thresholds.
Confidence 80 or higher and no error or critical flags in the evidence pass.
Confidence 50 to 79, no critical flags. Most new listings start here and climb as evidence lands.
Any critical flag, or confidence below 50. The failure and its reason are visible to the firm, and the fix path is the evidence, not a fee.
Evidence inconsistencies, dates that cannot all be true. A human decides, the listing says so while it waits.
Company verification
What a firm must show about itself, and how each claim is checked.
Certification registry checks
operatingNamed certifications verified against the issuer's public directory, holder by holder, with expiration dates. GIAC certifications (GICSP, GRID, and the rest of the family) against GIAC's holder directory; CREST membership against CREST's marketplace; ISO 27001 against the issuing body where the certificate identifies one. A claim that cannot be checked stays labeled self-reported.
What the buyer sees: The credential on the profile carries its evidence tier: registry-checked, with the issuer named.
Carrier panel documentation
operatingPanel memberships documented from the carrier's own published page, with source and access date. Never from a press release, never from the firm's claim alone. The ten published panels we track are re-read on a quarterly cycle and changes are published.
What the buyer sees: The carrier panels the firm appears on, and the ones it does not, each with its source.
Ownership and acquisition transparency
operatingAcquired firms carry the live owner on their profile, sourced from the acquirer's own announcement, so a buyer never contacts a brand that no longer exists as an independent practice.
What the buyer sees: An acquired-by chip on the firm card, the full note on the profile.
Incident response page verification
operatingEach firm's own incident response page is located and fetch-verified against their domain; where the site blocks automated fetches, Google's index is the second source, noted as such. IR pages are often buried, finding and keeping them is part of the pass.
What the buyer sees: A deep link to the firm's own response page, from the profile and the directory cards.
Engagement history with references
in developmentShips as an attestation-tier component, not a public-source component, because engagement detail is NDA-bound. The firm shows the engagement document under NDA (into the private vault); references are contacted from that document, never from numbers the firm supplies, under a published consent script. The public profile carries only the attestation: 'Reference-confirmed: N engagements, verified [date], evidence private.' The detail never publishes.
What the buyer sees: The attestation badge with its date and count. Under the buyer-side NDA tier, one level deeper: sector, date band, engagement type. Never names.
IR methodology review
in developmentA structured review of the firm's response methodology against the environment it serves: OT containment that respects production, cloud forensics that respect evidence, notification clocks the firm says it can meet. Scoring rubric drafted, reviewer calibration in progress. Findings are shared with the firm; the result is published, the findings are not.
What the buyer sees: A methodology review result, pass or with findings, on the profile.
Insurance coverage verification (E&O, cyber liability)
plannedDeclared, not operating. Ships as an attestation-tier component: certificates of insurance checked into the private vault, verified with the issuing broker, limits recorded, expiry tracked. The published marker confirms coverage in force and its verification date, never the certificate's contents. Critical-infrastructure buyers require this; the standard will carry it when the vault pipeline exists.
What the buyer sees: Nothing yet. When it ships: 'Insurance in force: E&O and cyber liability, verified [date].'
NDA-bound evidence: the attestation tier
Some of the strongest evidence about a responder — engagement history, references, unpublished panel memberships, insurance certificates — is bound by confidentiality the platform will not break. That evidence does not go on the public profile. Ever. What the platform publishes instead is an attestation: the criterion checked, the standard it was checked against, the date, and the result.
The trust problem a private check creates — believe us, we checked — is solved by process, not promises. The evidence lives in a private vault with an access log. References are contacted under a published consent script, from engagement documents the firm shows under NDA, not phone numbers the firm supplies. Both parties sign a hash of what was verified, so neither can misstate it later. And an anchor partner — an ISAC, a carrier, an independent auditor — can audit the vault process itself, which is the only claim stronger than our attestation.
The vault process is operating and the attestation is real, but no anchor partner has audited the process yet. The marker says so — it is the default until an audit exists.
An anchor partner has spot-audited the vault process and the audit is published on this page, clean or with findings. The partner is named in the marker.
Published attestation strings are fixed in the standard; if a fact needs a string that does not exist, the standard is amended in the open first. The vault retention policy, the reference consent script, and the audit terms are working documents in the program’s legal skeleton, reviewed by counsel before the first attestation runs.
Personnel verification
The named responders, not the logo. Certifications belong to people.
Named responder credential checks
operatingThe firm names its responders; each named person's certifications are checked against the issuer's holder directory. A named responder whose certificate cannot be found in the issuer's directory is recorded as not found, not assumed.
What the buyer sees: Named people, their registry-checked credentials, and the expiry dates on the profile.
Personnel background checks
plannedDeclared, not operating, and deliberately scoped: the platform is not a consumer reporting agency and does not run background checks. The firm attests it runs checks on its named responders; the platform verifies the existence, recency, and scope of that process, including a sample attestation under NDA in the private vault. The published marker confirms the process, never any individual's report.
What the buyer sees: Nothing yet. When it ships: a background-check-process-confirmed marker per named responder, attestation-tier.
Practical verification
The highest tier: observed work, not paper. Announced here before it operates.
Observed tabletop exercise, scored
plannedDeclared, not operating. The final tier: an observed exercise run to a published scenario, scored against this rubric, with the result on the profile. This is the heaviest verification component and it ships last, with the rubric public before the first exercise is observed.
What the buyer sees: Nothing yet. When it ships: exercise date, scenario family, score, findings summary.
Claims ledger
operatingEvery claim on a profile carries its source and access date, including this page's claims about itself. Claims move between tiers only when the evidence does.
What the buyer sees: The three evidence tiers on every listing: registry-checked, panel-documented, research-sourced.
What this standard does not do
- It does not sell placement. No firm pays to rank, appear, or keep a listing, the listing is free documentation and the fee buys the verification labor.
- It does not rank quality. The tiers grade evidence strength, not whether a firm is good, and every page that uses a tier says so.
- It does not publish NDA-bound evidence. Ever. Engagement documents, references, unpublished panels, insurance certificates, and background-check material live in the private vault; the profile carries the attestation and nothing more.
- It does not convert a private attestation into a public claim. The attestation badge says what was checked and when, and it is visually distinct from the public-evidence tiers so no one mistakes one for the other.
- It does not publish what it cannot source. A claim without a public source stays off the profile, and absence is recorded as absence.
- It does not claim components before they operate. Everything on this page is marked operating, in development, or planned, and the planned ones are empty promises until they are not.
How a firm gets verified
The same path for every firm: submit through the inclusion process, the platform runs the pass against public sources, the firm receives its claims ledger, and membership buys the deeper pass ( what membership pays for). A firm can dispute any finding through the corrections flow, and corrections are published.