Every control, every vulnerability and every incident, next to its evidence and its deadline

In order of importance. The first one sets up the configuration the others need.

1. 0security-setup

   The configuration, the inventory and what was excluded

   Input

   The root folder. Questions: entity and its tax ID, country, the period, where the statement of applicability in 00-referencia/ is and which column carries the control, whether it applies, its status, its owner and its frequency, the systems table with how often their access is reviewed, the third-party register with the critical ones and how often they are assessed, and the risk register in 40-riesgos/

   Process (calculated by the code)

   Inventory of what is there; lists what it excludes as a credential, key or backup; recognises each table's columns; compares the folder with the recommended structure; creates, moves or renames nothing

   Report

   Configuration saved; inventory by folder; what was excluded and why; the missing columns; the period's first record

2. 1security-scan

   The period record up to date, with the new evidence and the new signals

   Input

   The whole 10-controles/, 20-accesos/ and 30-terceros/

   Process (calculated by the code)

   The agent takes to the period record each piece of evidence in 10-controles/ with its control and the date it covers, each review in 20-accesos/ with its system, its date and who reviewed it, and each assessment in 30-terceros/ with its third party, its date and its result, every data point with its citation; the engine validates the record and says which document is not in it

   Report

   What went into the record; the documents not yet in it; the new signals; what could not be processed and why

3. 2soa-status

   Each applicable control with its owner

   Input

   The statement of applicability in 00-referencia/

   Process (calculated by the code)

   Each control in the statement with whether it applies, its status, its owner and its frequency; the engine does not rate maturity or declare a control met

   Report

   The applicable controls without an owner, with their row; the full statement

4. 3control-evidence

   Each control against the evidence that it operated

   Input

   The statement of applicability and the period record

   Process (calculated by the code)

   Each applicable control marked as implemented against the evidence in the record: whether it has any, and whether the latest falls within its frequency

   Report

   The controls without evidence and those whose evidence has lapsed, each with its citation and its owner

5. 4access-reviews

   Each system with its access review current or overdue

   Input

   The systems table in 00-referencia/ and the period record

   Process (calculated by the code)

   Each system against how often its access must be reviewed: the latest review in the record and when the next one was due

   Report

   The systems with an overdue review or none at all, with their citation

6. 5third-parties

   Each critical third party with its assessment current or overdue

   Input

   The third-party register in 00-referencia/ and the period record

   Process (calculated by the code)

   Each critical third party against how often its security must be assessed: the latest assessment in the record, its result and when the next one was due

   Report

   The critical third parties with an overdue assessment or none at all, with their citation

7. 6risk-register

   Each risk acceptance against its review date

   Input

   The risk register in 40-riesgos/

   Process (calculated by the code)

   Each risk with its decision; the accepted ones against their review date. The agent never accepts or closes a risk

   Report

   The acceptances past their review date, with who accepted them and their row

8. 7security-wake

   What was due today, run

   Input

   The state and the new documents

   Process (calculated by the code)

   If there are new documents or a week has passed, the full review; if there are open signals, their group's report; a question somebody left in Rostrum

   Report

   What ran and why, or that nothing was due

9. 8share-findings

   A summary with no data to share, only if you say yes

   Input

   The local trail of this agent's runs, in .criterio/corridas/

   Process (calculated by the code)

   The code builds a summary with no data —the plugin and its version, each command with how many times it ran and its median duration, each signal by its code with how many times it came up— and always asks whether you want to share it; nothing is sent (decision 0025)

   Report

   The summary as is and, with a yes, the link to the repository's finding template, which the person opens

In order of importance. The first one sets up the configuration the others need.

1. 0vuln-setup

   The configuration, with the policy's deadlines, and the format of each export

   Input

   The root folder. Questions: entity and its tax ID, country, the period, the remediation deadline for each severity in the vulnerability management policy in 00-referencia/, which scanner produces the exports in 50-escaneos/ and, if their columns are not recognised, which column carries the asset, the vulnerability, the severity or the CVSS score and the first detection, how many days without a scan leave an asset uncovered, and whether its reports are published in Rostrum

   Process (calculated by the code)

   Inventory of what is there; lists what it excludes; recognises the columns of each scanner export and of the KEV catalog (F-06); the agent extracts each severity's deadline from the policy, with its citation; creates, moves or renames nothing

   Report

   Configuration saved, with the deadlines and their citation; inventory by folder; each export with its date, its assets and its findings; the missing columns

2. 1vuln-scan

   What is open, up to date, with the new signals

   Input

   The whole 50-escaneos/ and 60-remediacion/

   Process (calculated by the code)

   The code processes each export with its date: what is open is what each asset's latest scan found, with the date it was first detected; the severity is the scanner's or, if it only gives the score, the CVSS scale's (F-05); it crosses the KEV catalog (F-06), the tracker and the exceptions

   Report

   The scans with their assets and findings; what is open; the KEV catalog used; the new signals; what could not be processed and why

3. 2vuln-sla

   Each open vulnerability against the policy's deadline

   Input

   The exports in 50-escaneos/, the exceptions in 60-remediacion/ and the deadlines in the configuration

   Process (calculated by the code)

   Each open vulnerability against its severity's deadline, counted from its first detection; a current exception suspends it; an expired exception on something still open is a signal

   Report

   The vulnerabilities past their deadline and the expired exceptions, each with its asset, its severity, its days and its citation

4. 3kev-check

   Each exploited vulnerability still open

   Input

   The exports in 50-escaneos/ and CISA's KEV catalog (F-06)

   Process (calculated by the code)

   Each open vulnerability whose CVE is in the catalog, against the remediation date the catalog gives; says whether its use in ransomware is known

   Report

   The catalog's vulnerabilities still open past their date, with their asset and their citation

5. 4scan-coverage

   Each asset with its scan, and each closure with the scan that proves it

   Input

   The asset inventory in 00-referencia/, the exports in 50-escaneos/ and the tracker in 60-remediacion/

   Process (calculated by the code)

   Each in-scope inventory asset against the latest scan that includes it and the configured window; each vulnerability closed in the tracker against the scans after its closure

   Report

   The assets with no scan in the window; the closures no later scan proves or that the scan still finds; what was scanned outside the inventory

6. 5vuln-wake

   What was due today, run

   Input

   The state and the new documents

   Process (calculated by the code)

   If a new export, catalog or tracker arrived, or a week has passed, the full review; if there are open signals, their group's report; a question somebody left in Rostrum

   Report

   What ran and why, or that nothing was due

7. 6share-findings

   A summary with no data to share, only if you say yes

   Input

   The local trail of this agent's runs, in .criterio/corridas/

   Process (calculated by the code)

   The code builds a summary with no data —the plugin and its version, each command with how many times it ran and its median duration, each signal by its code with how many times it came up— and always asks whether you want to share it; nothing is sent (decision 0025)

   Report

   The summary as is and, with a yes, the link to the repository's finding template, which the person opens

In order of importance. The first one sets up the configuration the others need.

1. 0resilience-setup

   The configuration, with the policy's deadlines

   Input

   The root folder. Questions: entity and its tax ID, country, the period, the containment deadline for each severity and the days for the post-incident review in the incident response policy in 00-referencia/, the notification matrix with each recipient, when it applies and its deadline, and the continuity calendar with each test, its type and its frequency

   Process (calculated by the code)

   Inventory of what is there; lists what it excludes; the agent extracts each severity's deadline and the post-incident review's from the policy, with their citation; recognises the matrix's and the calendar's columns; creates, moves or renames nothing

   Report

   Configuration saved, with the deadlines and their citation; inventory by folder; the missing columns; the period's first record

2. 1resilience-scan

   The period record up to date, with the new incidents, reviews and tests

   Input

   The whole 70-incidentes/, 80-revisiones/ and 90-continuidad/

   Process (calculated by the code)

   The agent takes to the period record each incident in 70-incidentes/ with its severity, the detection, containment and closure with their time, whether personal data or customers were affected, and each notification with its recipient, its time and its record; each review in 80-revisiones/ and each test in 90-continuidad/ with its date and result; every data point with its citation (F-04); the engine validates the record

   Report

   What went into the record; the documents not yet in it; the new signals; what could not be processed and why

3. 2incident-timeline

   Each incident against its severity's deadline and its review

   Input

   The period record and the deadlines in the configuration

   Process (calculated by the code)

   Each incident: the hours from detection to containment against its severity's deadline, and its post-incident review against the policy's days from closure

   Report

   The incidents contained late or not contained, and the closed ones without a review or reviewed late, with their citation

4. 3notifications

   Each notification the matrix requires, on time, late or not made

   Input

   The notification matrix in 00-referencia/ and the period record

   Process (calculated by the code)

   Each incident against every row of the matrix that applies to it —by its severity, personal data or affected customers—: the recorded notification and its time against the deadline from detection. The agent notifies no one

   Report

   The late notifications and the ones never made, with their recipient, their rule and their citation

5. 4continuity-tests

   Each test against its calendar

   Input

   The continuity calendar in 00-referencia/ and the period record

   Process (calculated by the code)

   Each test in the calendar —the continuity plan, the recovery plan, each critical backup's restore— against its frequency: the latest in the record, its result and when the next one was due

   Report

   The tests that are overdue or never done, with restores apart, with their citation

6. 5resilience-wake

   What was due today, run

   Input

   The state and the new documents

   Process (calculated by the code)

   If a new incident, review or test arrived, or a week has passed, the full review; if there are open signals, their group's report; a question somebody left in Rostrum

   Report

   What ran and why, or that nothing was due

7. 6share-findings

   A summary with no data to share, only if you say yes

   Input

   The local trail of this agent's runs, in .criterio/corridas/

   Process (calculated by the code)

   The code builds a summary with no data —the plugin and its version, each command with how many times it ran and its median duration, each signal by its code with how many times it came up— and always asks whether you want to share it; nothing is sent (decision 0025)

   Report

   The summary as is and, with a yes, the link to the repository's finding template, which the person opens

16 signals. Each is raised with the control, system, third party, vulnerability, asset, incident or test that causes it, and the citation of the document; the deadlines come from each entity’s policy, matrix and registers, with their citation.

Recommended, not mandatory: the agents process the folder as it is. Setup says which file is out of place and where it would go, without creating, moving or renaming anything. It looks for the entity’s security folder, proposes it with its reason and, if you say yes, marks it with a visible file, _CRITERIO_SEGURIDAD.txt. Credentials, keys and backups are excluded by default and never opened; every report says which ones it excluded. They write nothing else among your documents: what they find goes in their state, apart.

One folder per entity, with its tax id at the start of the name. Inside it, the policies and reference registers, each control's evidence, the access reviews, the third-party assessments, the risk register, the scanner exports, the remediation, the incidents, their reviews and the continuity tests. Never credentials, keys or backups: the engine excludes them.

seguridad/
└── <entidad>/
    ├── 00-referencia/
    ├── 10-controles/
    ├── 20-accesos/
    ├── 30-terceros/
    ├── 40-riesgos/
    ├── 50-escaneos/
    ├── 60-remediacion/
    ├── 70-incidentes/
    ├── 80-revisiones/
    └── 90-continuidad/
estado-seguridad/

estado-seguridad/ · What Alexis, Guillermo and Amparo write: the configuration, each period's record, the reports and the indexes. No person edits it, and no agent writes anywhere else.

The role, from O*NET; the family’s order, from NIST CSF 2.0; incident response, from NIST SP 800-61 Rev. 3; severity, from the CVSS v4.0 scale, and the KEV catalog, from the file CISA publishes, field by field. No country’s law enters the calculation. ISO/IEC 27001 and BOD 26-04 are still to be verified, and the engine rests on neither.

• F-01

  O*NET · 15-1212.00 Information Security Analysts

  Datos de 2026 (O*NET OnLine) · onetonline.org ↗

  Verified
• F-02

  NIST · The NIST Cybersecurity Framework (CSF) 2.0 · NIST CSWP 29

  Publicado el 26 de febrero de 2024 · nist.gov ↗ · nvlpubs.nist.gov ↗

  Verified
• F-03

  ISO/IEC 27001:2022 · Anexo A

  La edición de 2022, con sus 93 controles en cuatro grupos (5 a 8) · iso.org ↗

  To be verified
• F-04

  NIST · SP 800-61 Rev. 3 · Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile

  Publicada el 3 de abril de 2025; reemplaza la Rev. 2 · nist.gov ↗ · nvlpubs.nist.gov ↗

  Verified
• F-05

  FIRST · Common Vulnerability Scoring System v4.0 · Specification Document

  CVSS 4.0, publicado el 1 de noviembre de 2023; documento versión 1.2 · first.org ↗

  Verified
• F-06

  CISA · Known Exploited Vulnerabilities Catalog · el archivo CSV

  El archivo publicado al 28 de octubre de 2026, con doce columnas · github.com/cisagov/kev-data ↗

  Verified
• F-07

  CISA · Binding Operational Directive 26-04 · Prioritizing Security Updates Based on Risk

  Emitida el 10 de junio de 2026; revoca y reemplaza la BOD 22-01 · fedramp.gov ↗

  To be verified

• Alexis on GitHub ↗
• Guillermo on GitHub ↗
• Amparo on GitHub ↗
• Rostrum on GitHub ↗
• The full design ↗
• The sources (in Spanish) ↗
• What the material plants ↗
• The decision that created it ↗
• Meet the PMO family, built and tested →