The open standard that defines how software is scored — a published, auditable rubric that rates a codebase across five dimensions and returns a number anyone can reproduce.
HICS is a published method, not a tool. The HICS scoring algorithm (v1.0.0, effective 2026-03-30) defines every weight, threshold, and deduction, so any implementation that follows it reaches the same score on the same code. The command-line scanner is an implementation of the standard, not the standard itself — the methodology is public and auditable; the tooling is one conforming way to run it. Trust the rubric, not the vendor running it.
A HICS score is a weighted composite over five dimensions:
Final = (Crypto × 0.30) + (Vulnerability × 0.25) + (Data × 0.20) + (Ops × 0.15) + (Health × 0.10)
Findings are confidence-weighted (deduction = base × confidence), post-quantum adoption earns positive credit, and the result maps to grade bands (A through F−) — there is no binary pass/fail. Every rule is published: read the full methodology.
| A HICS score is | A HICS score is not |
|---|---|
| a rating against a published rubric | a statement that the software is secure |
| reproducible from the same code and rubric version | a verification verdict (that is Verification’s) |
| one data point for a human decision | a statement of legal or regulatory compliance |
| a point-in-time snapshot (attestations expire) | a security audit or continuous assurance |
A high score does not mean secure. A low score does not mean insecure. HICS performs automated pattern analysis; it is not a security audit. Per the terms, a HICS score is not a substitute for independent professional security review, compliance assessment, or legal counsel, and should not be the sole basis for legal, compliance, or procurement decisions. An attestation verifies computational integrity only — that the scoring algorithm ran correctly on the committed bytes — not that the codebase represents production software.
A score can be sealed into a portable attestation and independently verified — but HICS performs neither step. HICS produces the rating; the rating is sealed by the attestation layer (a STARK proof of correct execution plus a post-quantum signature over a codebase commitment), and the sealed artifact is checked by an independent verifier. The chain is one-directional and each link belongs to a different concept:
HICS produces the score → H33-74 seals it into an artifact → the verifier checks the artifact
So a HICS score never verifies itself, and the standard never claims to be its own proof.
HICS is the scoring layer above the capabilities, and it composes its neighbours without absorbing them:
| Relationship | Neighbour | What stays theirs |
|---|---|---|
| SCORES_OVER | HATS | HATS records that controls operated as declared; HICS rates that operational evidence against its rubric. HICS never records the evidence itself. |
| INCORPORATES | PQ-Verified | PQ-Verified is the authority on whether a system is post-quantum conformant; the HICS Crypto dimension consumes that judgment. HICS credits PQ adoption — it does not re-assert conformance. |
Together the three complete the standards layer: HATS records operational evidence, HICS scores it, and PQ-Verified asserts post-quantum conformance.
| Procurement & vendor due-diligence | a reproducible, rubric-based rating to compare suppliers — one input, not a verdict |
| SLA / attestation clauses | a Proof ID a vendor can cite, checkable by the counterparty |
| Cyber-insurance underwriting | a standardized signal alongside HATS control evidence |
What HICS consumes: the codebase under evaluation, the operational evidence HATS records, and the conformance status PQ-Verified asserts.
What makes a score a valid HICS score is the published rubric at a stated version — HICS scoring algorithm v1.0.0, effective 2026-03-30. Because every weight and rule is public, a score is reproducible and independently auditable: two implementations of the same version reach the same number on the same code. Methodology · Terms & scope.
Read the published rubric, or score a codebase against the standard.
Read the scoring formulaHICS does not create the attestation. The attestation layer seals a score; HICS produces the rating.
HICS does not render a verdict. An independent verifier checks a sealed score.
HICS does not watch a running system — a score is point-in-time. HATS monitors continuously.
A score is not legal or regulatory compliance, and not a substitute for professional review.
A high score is not a security guarantee; a low score is not proof of insecurity. It is one data point.
HICS does define a transparent, reproducible rating of software against a published, auditable rubric.