Home · Indicators of confidence
The five indicators of confidence, and the draft thresholds
The published framework sets five indicators of confidence, from asserted to strict. The public working draft of the benchmarking part gives an external benchmark for four of them. Those benchmarks are a planning reference from a working draft, not a published requirement, and the DIS text may change them. Confirm every figure against the published edition before you use it in a contract.
The benchmark column is from a public working draft. It is a planning reference, not a published requirement. The DIS text may change it, and a contract should not rest on it until the published edition confirms it.
| Clause | Indicator | Draft benchmark | What it means | What the comparison must add |
|---|---|---|---|---|
| 6.1.1 | Asserted | No benchmark | A self-declared age, with no component used to validate it. | The framework assumes asserted assurance is not benchmarked for correct classification. It is the floor of the scale, not a candidate for a decision that needs real assurance. |
| 6.1.2 | Basic | At least 90 per cent | The first level above an unvalidated claim, with a measured classification result. | The benchmark is the draft's external reference. A comparison still has to show the sample and the class balance behind the figure. |
| 6.1.3 | Standard | At least 99 per cent | A mid-scale claim that needs a larger and better controlled test than a basic one. | A sample sized for a basic claim cannot support this figure with any confidence. |
| 6.1.4 | Enhanced | At least 99.9 per cent | A high claim in which the test design dominates the result. | The uncertainty matters as much as the point estimate. A small or convenient sample cannot carry the figure. |
| 6.1.5 | Strict | At least 99.99 per cent | A claim about rare failures, which needs a sample large enough to observe them. | An attack assessment and an independent report belong beside the figure. Without them the label is a promise, not a measurement. |
Framework: ISO/IEC 27566-1:2025, clause 6. Benchmarks: WG 5 N3928, clause 4.3.1, a public working draft.
How to choose the indicator
The decision chooses the indicator, not the supplier. A board paper on a low-risk service may need a basic result; a regulator's market review or a strict claim about a high-risk service needs the top of the scale and a sample large enough to support it. Where a policy maker has set a threshold, that threshold wins over the draft figure on this page.
What the figure does not include
The benchmark is a classification accuracy at a binary threshold. It does not include binding, privacy, the equality analysis or the attack result. A system can meet the figure and fail every one of those, which is why the report has separate lines for them and why the kit's register does not collapse them into a score.