The MEA Assurance Interoperability Standard

What MAIS is

 

MAIS is an open taxonomy that allows an organisation to state a fact about its security posture once, and have that statement evaluated correctly against multiple cybersecurity frameworks — each in that framework's own native assessment language.

 

It is not a platform, a certification, or a replacement for your GRC tooling. It is the shared vocabulary and translation logic that has been missing between frameworks.

​

​

​

The five layers

 

Layer 1 — Atom: Evidence Primitives. Atomic, framework-neutral, PRAECEPTA-authored statements of an evidentiary condition. Each carries named evidence artefacts, an accountable owner role, a refresh cadence, and an automation feasibility rating.

 

Layer 2 — Map: Relationship semantics. Directional relationships between primitives and framework units — equivalence, subset, and intersection — with a strength indicator, consistent with the set-theory approach described in NIST IR 8477.

 

Layer 3 — Grammar: Assessment Grammar Transform. Each framework's evaluation logic, expressed as declarative executable rules. This layer is PRAECEPTA proprietary. It is where interoperability actually happens, and it is the part no crosswalk provides.

 

Layer 4 — Delta: Irreducible divergence. The quantified, reasoned register of where frameworks cannot be reconciled.

 

Layer 5 — Render: Output. Governed Excel workbook, diagram-as-code architecture, board-ready reporting, and machine-readable OSCAL export.

​

​

​

Design principles we will not break

​

1. No framework text is reproduced. References are by control identifier only.

2. No static counts or percentages. All quantities are computed from versioned data at generation time.

3. Every assertion is original. Primitives describe evidence, in our own words, never a control's wording.

4. Framework detail is isolated to data. A regulator's revision is absorbed by a data change, not a rewrite.

5. Provenance is mandatory. Every mapping records its source document, version, date, clause, retrieval date, author and verification status.

6. Precise language. We say "assessment-ready". We never say "compliant" or "certified" — those words belong to regulators, certification bodies and auditors.

​

​

​

Scope of v0.1

 

Two evidence domains — Governance, Risk & Assurance and Detection, Monitoring & Threat — modelled completely against six frameworks. We chose depth over breadth deliberately. A shallow model across twenty frameworks proves nothing; a complete model across two domains proves the method.

 

 

[Frameworks & versions →]           [Delta Register →]

​

​​

​

​

​The full v0.1 specification is in preparation and will be published under CC BY 4.0. Request a copy and we will send it on release.

​

​​

​

Licence

 

The MAIS taxonomy is licensed Creative Commons Attribution 4.0 International. You may share and adapt it, including commercially, with attribution. We chose a licence permitting derivatives on purpose: a standard that cannot be built upon is not a standard.

 

The reference implementation is Apache-2.0. The Assessment Grammar Transform engine and Delta Register content are proprietary to PRAECEPTA.

​

​

​

Comment on v0.1

 

This is a draft. Structured comments received before 31 October 2026 will be adjudicated in v0.2, and contributors credited.

 

​