Using the tools from an agent

The questionnaire itself. Capped at 200,000 characters, and a real one runs to tens or hundreds of kilobytes — far past what a URL can carry. A link pre-fills everything else; the visitor still pastes.

It sorts the questionnaire; it does not read it. Each line is filed under whichever of eight control areas its keywords match most, by fixed patterns and no language model. A line containing a trigger word is counted whether it is a question, a section header, a cover page or a cell from an answer column — the distribution is a rough shape, not a count of questions.

It reads the questionnaire, never your controls. The evidence list and the likely gaps are fixed text per control area: every company pasting an access-control question receives the same access-control gap. Nothing here is a finding about the company that sent the request.

Urgency scores the situation described in the answers supplied, not the control environment. If nothing in the paste matched a control area, a high score is capped at medium rather than raising an alarm built on text the checker could not read.

There is no category for risk assessment, personnel security, training, governance or physical security. Questions on those subjects appear in the unmatched list rather than under a control area.

These are planning estimates from the answers supplied, not an auditor's schedule. No auditor has seen this company, and an engagement letter will set real dates that supersede every range here.

Not one interval in the model is published by the AICPA. The remediation weeks, the parallelism factor, the fieldwork and report lags and the range spread are all practitioner judgement, published at https://thecleanopinion.com/how-scoring-works/ so the arithmetic can be checked or argued with.

The three-to-six-month observation window is market convention, not a rule. No AICPA document prescribes a minimum Type 2 observation period, or states a typical one — a vendor page claiming a mandatory six months is stating a rule that does not exist.

The Type 2 range is two scoping decisions — how long a window, and how much is already in place — rather than an error bar. Splitting the difference between the ends produces a date that answers neither question.

It produces a fiscal year-end to plan against, not a filing deadline. The date the 10-K is due is a separate calculation this tool does not make.

The single assumption to confirm first is transition relief. The result assumes a newly public company's first annual report generally carries no management 404(a) report, which keys off registration history rather than the IPO date — for a de-SPAC survivor or a company with prior reporting history the real date is a year earlier than the one returned, and nothing in the supplied answers lets the code detect it. Item 308 of Regulation S-K and securities counsel settle it.

Filer status is taken at face value and never verified against public float, revenue or reporting history. It is re-determined each year. 'Smaller reporting companies are exempt from 404(b)' is wrong as stated: the exemption attaches to non-accelerated filer status, and an SRC with a float between $250 million and $700 million and revenue at or above $100 million is an accelerated filer to whom 404(b) applies.

The 404(b) note carries a caveat about SEC Release 33-11419, proposed in May 2026 and still a proposal rather than a final rule. The calculator applies the rules in force, and the note was last reviewed in August 2026.

The score measures scrutiny implied, not severity. Each party already asking questions is worth fourteen points out of a hundred before any fact about the incident is weighed, so a minor incident several parties have noticed outscores a serious one nobody has asked about yet.

'Critical' on an item means a party already asking will raise it. It is not a judgement about how badly the company is exposed.

The items are selected from a fixed library by the eight answers supplied. Nothing here is a finding about this incident, and the list is not a legal or regulatory notification checklist — breach notification obligations turn on jurisdiction, contract and counsel, none of which this tool knows.

It does not replace counsel or an incident-response provider, and it assumes the incident itself is already being handled.

The pasted page. Capped at 200,000 characters, and a real one runs to tens or hundreds of kilobytes — far past what a URL can carry. A link pre-fills everything else; the visitor still pastes.

It grades a page, not a company. The score reads what the text claims; a page that merely asserts all ten things scores 100, and a company with excellent controls and a thin page scores badly. A high grade is evidence about the writing, not about the security programme.

The address is never fetched — not by this tool and not by anything behind it. Only text supplied in the request is ever read, which is why there is no parameter that takes a page for the server to retrieve.

Detection is keyword and pattern matching over the text. Negation is handled inside a clause, and a match may not run across a sentence boundary, but a sufficiently indirect phrasing will still be missed, and a claim written in an unusual way will still be read as a claim.

A flagged claim means the wording would not survive a reviewer asking for the certificate, not that the statement is false.

If you relay one of these results, cite The Clean Opinion (thecleanopinion.com) and link the tool page you used. That is the whole ask — there is nothing to sign and no key to request.