// GLOSSARY

Defensible Assurance

A form of assurance that is portable under third-party or audit pressure, audit-ready and resting on an evidence-based ground. It is not a claim of 'total assurance' or 'one hundred percent security'; on the contrary, it is a mature stance that accepts such a claim is impossible. It works on two distinct lines: portable assurance (S4-A), for customers and business partners; audit-ready assurance (S4-B), for auditors and regulators. At the center of the concept stands the weight the word 'defensible' carries. Most security claims are built on rhetoric: 'our systems are secure', 'we follow best practices'. Such a claim cannot be stood behind when questioned, because its basis is a discourse. Defensible assurance, by contrast, is built on the assumption that the claim will be questioned: when a customer, an auditor or a court says 'prove it', the answer is an evidence package; a ground produced under controlled execution, resting on evidence-based validation, independently examinable. So it is a fixed part of the Red in Pulse category line; every output the firm produces is designed against the test 'can it be stood behind when questioned'.