Instrument Specification · Version 1.0
Vordan External Posture Assessment
The external audit. Public record only. Six fixed components, mandatory confidence intervals, and a Posture Score on a 1–5 scale. Deployable against any publicly observable entity without organizational cooperation.
VEPA
Version 1.0
Active
Public Record Only
Posture Score 1–5
What the VEPA measures
The VEPA evaluates the observable accountability posture of any organization, platform, or institution using the public record as its sole evidentiary basis. It requires no organizational cooperation. Its findings are scoped explicitly to what is observable, and its methodology is published so that any finding can be evaluated, contested, or verified by any party with access to the same public record.
The VEPA is the instrument that makes accountability assessment independent. Where the VAF requires access, the VEPA requires only evidence. Evidence, by definition, is already public. The difference between a VEPA finding and an opinion is the citation. Every finding is sourced. Every score is bounded by a confidence interval. Every unscored component is explicitly documented with the reason.
Independence from the assessed entity is the source of this assessment's credibility. The VEPA is designed so that its most important findings can be made and sustained without organizational cooperation: and so that the only remedy available to a scored entity is to produce the evidence that would close the gap.
Six fixed posture components
P1
Traceability
Where did the awareness come from, and when?
Whether a clear, documented chain of awareness exists. Can the assessor reconstruct when the entity first identified the threat or failure, what it knew, what it disclosed, and when, from the public record alone?
P2
Structural Accountability
Does the governance model match actual risk distribution?
Whether the entity's published governance model accurately reflects the actual distribution of risk, or systematically shifts accountability burden onto parties less equipped to bear it.
P3
Response Adequacy
Was the response commensurate with the threat?
Whether observable response actions (advisories, platform changes, customer communications, tooling releases) were commensurate in scope, speed, and substance with the documented nature and scale of the threat.
P4
Governance Alignment
Does practice match commitment?
Whether the entity's observable security governance practices align with its published commitments and applicable industry baseline standards. Where gaps exist between commitment and practice, whether they are acknowledged.
P5
Disclosure Integrity
Are disclosures accurate, complete, and timely?
Whether the entity's public disclosures are accurate, complete, and timely. Accuracy without completeness is a disclosure integrity failure. Both dimensions are assessed independently.
P6
Remediation Trajectory
Is there a credible path toward closing the gap?
Whether the entity has demonstrated a credible, documented trajectory toward closing identified gaps through structural changes, not advisory-level guidance, that make the identified failure materially less likely to recur.