Research · Scheduled study
Security evidence acceptance rates by framework
Scheduled study. From readiness and evidence-preparation engagements with client permission, an annual analysis of first-submission acceptance rates for security evidence by framework (ISO/IEC 27001, SOC 2, CMMC Level 2, customer questionnaires, cyber insurance applications), by evidence type, and the categories of reason for which evidence was rejected or returned. Organizations are reported in aggregate, never by name. Publication date will be announced on this page.
Status: Scheduled; publication date will be announced on this page · Cadence: annual
Research question
What the study will answer.
What share of security evidence is accepted by the examiner on first submission, how does it vary by framework and by evidence type, and what are the most common reasons evidence is rejected?
Planned method
How it will be done.
- Engagement records contributed with client permission: evidence items submitted, examiner, framework, type, outcome on first submission, reason category where returned.
- Classification of rejection reasons into a published taxonomy (undated, incomplete population, policy where record expected, inconsistent with other evidence, out of period, other).
- Aggregation by framework and evidence type; organizations never identified.
Why it matters
Who will use the number.
Organizations prepare evidence without knowing what examiners actually reject. A published rate and reason taxonomy makes preparation specific rather than general.
Participate
How to take part.
Organizations and partners may contribute anonymized evidence outcomes. Contact us for the data-sharing terms.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days