Track-record credibility
Is there evidence this has been deployed and survived contact with production?
Requirements, evidence source, and references
This page is the citable form of this dimension — a finding elsewhere can link straight to the bar it was judged against.
Track-record credibility
5 requirementsIs there evidence this has been deployed and survived contact with production?
A named production deployment, rather than a pilot described in the abstract.
Whether the customer is named, or only a sector is.
Whether the deployment is production or an evaluation.
Published case studies contain actual data rather than only qualitative claims.
Partnership and ecosystem announcements are recorded as what they are, and never counted as deployment evidence.
How long the deployment has run and at what scale, where either is discoverable.
Publicly known incidents or defects affecting the cryptographic product, and how the vendor handled them.