How CHQ Ratings Work

Methodology for the CHQ Structural Condition Report

Version 1.3. Declared 25 September 2026. Published Issue No. 40, 29 September 2026. In force from Issue No. 41, 6 October 2026. Supersedes v1.2 (applied from 18 August 2026). Change record: CHQ-METH-2026-v1.3.

Prior versions: v1.2

Published so readers can attack the criteria rather than take the ratings on faith. This page governs every rating CHQ publishes. Where a rating and this methodology conflict, the rating is wrong.

What CHQ rates

CHQ does not rate vendors, products, or incidents. It rates structural conditions: durable properties of how systems are built and operated that make classes of attack possible. An incident is evidence. The condition is what persists after the incident is patched.

The board carries six to ten conditions at a time. A condition is added only when defined evidence thresholds are met, and every addition, change, and removal is published as a rating action.

The rating scale

Ratings are three defined states, not letter grades. Each maps to a mechanical evidence threshold, so any reader can check whether a rating is justified.

EMERGING. Observed; evidence is demonstration, proof of concept, or limited and contested, below the declared confirmation threshold.

STRENGTHENING. Recurs across independent instances, or a single qualifying real-world event has occurred. One event places a condition here and fixes the threshold it must cross.

CONFIRMED. The declared confirmation threshold has been crossed through sustained evidence across instances that pass the independence test.

Rating-basis qualifier, not a rating state. "Grandfathered" marks a CONFIRMED rating assigned under a rule since removed and retained under the non-retroactivity provision below. It adds no fourth state to the scale. It discloses that the rating has not been tested against the current standard, and the quarterly criterion audit decides whether it stays supportable.

CHQ does not use lettered scales. Letters borrow the authority of statistical calibration that these conditions do not yet have. When CHQ's own track record is long enough to support base rates, that record will be published rather than implied.

Independence of instances

Two incidents count as independent evidence only if they differ in domain, observation source, and failure mode. The same flaw class in five products from one root cause is one observation, not five. One causal run counts once.

A second test applies to actors. Under the Alignment Bias Rule (CHQ-ABR-2026-001), reinforcement attributed to the same actor or the same campaign is weighted as actor reach, not as independent structural confirmation. Neither actor identity nor publisher identity decides independence on its own; the evidence chain does.

The confirmation threshold is stated per condition and is actor-agnostic: it counts independent instances at the required evidence grade, whoever the actor is.

Evidence grades

Evidence is graded under the CHQ Criteria Governance Standard (CGS v1.0, sections 2 and 3) before it may move a rating. Grade A is authoritative primary material: government catalog data and alerts, CVE records, securities filings, vendor security advisories, court and regulatory records. Grade B is direct technical material: vendor research with telemetry, incident-response reports with direct observation, original research with reproducible evidence, an operator's own incident postmortem. A rating-changing event requires Grade A or B evidence for each proposition the criterion depends on. Attribution, actor identity, campaign linkage and impact are graded separately from the exploitation they attach to.

What every rating must carry

No condition is rated without five items, defined in advance and on record:

Current evidence. The instances that justify the state.
An up-trigger. The mechanical condition that raises the rating.
A down-criterion. The mechanical condition that lowers it. No rating is issued that cannot be lowered.
A watch condition. The evidence state that places it on Watch.
A materialization event. A publicly checkable event class, declared in advance, that counts as the condition happening. The rating is thereafter accountable to the frequency of that event, not to editorial judgment.

Outlook is not a forecast

Outlook is assigned by rule over a trailing 28-day window from the date an instance became publicly countable: Accumulating when a counted instance entered the window, Stable when none did and none left, Receding when the evidence direction is down. It reports what has been observed, not what CHQ expects. The 28-day window length is provisional and is reviewed at the quarterly criterion audit.

Watch means a defined reclassification trigger is mechanically near on current evidence. CHQ does not publish predictions of future events in its ratings.

The maintenance rules

Every rated condition is reviewed every issue. Conditions that did not move are published as Affirmed, because an affirmation only carries information if review was mandatory. De-escalation is mandatory when a down-criterion is met. A condition with no supporting evidence across a defined number of cycles is withdrawn, publicly, with the reason stated. Every rating action is recorded in an append-only transition log that constitutes the board's public track record: how long conditions take to confirm, how often Watch resolves into reclassification, and how often CHQ was wrong.

A rating that cannot be reconstructed from its evidence, admissibility grade, criterion version and state transition is not defended; it is placed under review. "Under review" is used only where a valid criterion exists to review against.

Corrections

A correction to a prior issue is published at the volume of the original claim (CGS-10.3). A published evidence count that later fails the criterion in force is qualified in print, whether or not the rating changes. Corrections are an error class in the track record and are scored.

Non-retroactivity

No methodology change applies retroactively to alter the validity of a rating action taken under the version in force at the time (CGS-11.3). A rating assigned under a rule since removed is retained, disclosed as grandfathered, and referred to the quarterly criterion audit, which may lower it. SC-2026-008's 7 July 2026 confirmation under the v1.2 single-event clause stands on this basis and is disclosed as grandfathered from Issue No. 42.

Being wrong in public

CHQ maintains internal, dated, falsifiable forecasts tied to rated conditions. They resolve on their expiry dates and the resolutions are published at equal fidelity, including the misses. A forecast satisfied by evidence that was public before the forecast was issued and absent from the registry at issuance is scored RETROSPECTIVE_DISCOVERY, not MET, and is excluded from the hit rate (CHQ-FORECAST-RETRO-2026-001). Forecasts are never evidence for rating actions. A rating or a call that cannot be wrong is marketing, and CHQ does not publish marketing as analysis.

Independence

The ratings are not sponsored and cannot be. Sponsored work is disclosed, separate, and governed by the CHQ Independence and Sponsorship Policy, published alongside this page. No commercial relationship influences what is rated or how.

Limitation

Evidence collection, grading and adjudication at CHQ are presently performed by one analyst. An integrity gate and adversarial review are applied before publication. The quarterly criterion audit is an internal review procedure, not independent oversight, for as long as the same analyst proposes, adjudicates and ratifies.

Change record

v1.3 (declared 25 September 2026; in force 6 October 2026; record CHQ-METH-2026-v1.3). Three changes, each tested retrospectively under CGS-7 before declaration, with results published in Issue No. 40:

CONFIRMED entry rule. A single qualifying real-world event places a condition at STRENGTHENING and fixes the confirmation threshold it must cross. v1.2 allowed a single qualifying event to confirm. Retrospective test: SC-2026-008 is the only CONFIRMED entry resting on the single-event clause; SC-2026-002, 007 and 009 rest on multiple instances. Under CGS-11.3 no existing rating moves; the SC-2026-008 action of 7 July stands and is disclosed as grandfathered.
Confirmation-threshold sentence made actor-agnostic. Clarification; effective on declaration.
Outlook assigned by rule over a 28-day window. Retrospective test against Issue No. 39: rule and published Outlook agree on seven of seven. Window length provisional; 42 days was rejected as leaving the board saturated. Reviewed at the Q4 criterion audit.

No state was added, no modifier was added, and the ceiling-consequence rule (CHQ-CEILING-2026-001) is unchanged.

v1.2 (applied from 18 August 2026). Rating-scale wording revised; Watch and Outlook v1.0 definitions adopted. Text retained at /ratings-methodology/v1.2.

v1.0 (13 July 2026). First publication.

This methodology is versioned. Material changes to it are themselves published as actions, with reasons. Prior versions remain available.