TSEP-1 · 27 controls
Public sources
Start with public observations and declared context. Each control’s required inputs and reviews must still be supplied.
Protocol resources
The language of TSEP.
A shared meaning.
Shared vocabulary for reading controls, preparing evidence and explaining outcomes. These editorial definitions accompany the protocol version shown below.
01 / Understand
The words.
Their scope.
- Observation
- A fact recorded in a specific context and at a specific time: an HTTP response, a received document or data from a tool. Interpreting it requires an expectation and a scope.
- Evidence
- A retained, attributed and dated item supporting a finding: an HTTP original, export, log or documented review, depending on the control. Its presence alone is not enough to establish an outcome.
- Intent
- The objective declared before checking: the expected resource, its access or destination. The observed outcome must not retrospectively redefine success.
- Scope
- The URLs, hosts, dates, agents and conditions covered by a check. A sample does not automatically represent the entire website.
- Control
- An identified unit from TS01 to TS44, with applicability, expectations, evidence and limitations. A control may contain several atomic rules.
- Atomic rule
- An identified requirement within a control, with its own inputs and outcome conditions. Read all applicable rules before assigning an outcome to the control.
- Evidence profile
- A set of controls associated with available evidence sources and access. TSEP-1, TSEP-2 and TSEP-3 organise evidence; they are not website quality grades.
- C · Conforming
- Applicable expectations are satisfied in the assessed scope, with the required evidence. Do not extend this outcome to unassessed items.
- NC · Nonconforming
- A contradiction of an applicable expectation is supported by evidence. Identify the relevant evidence, rule and scope.
- NT · Not tested or inconclusive
- The check was not performed or the available material does not support a conclusion. Missing evidence remains a gap, not a success.
- NA · Not applicable
- Non-applicability is established under the control’s conditions. Lack of access is insufficient; some executable profiles do not produce this outcome.
- Version
- The specific edition of the protocol, rule, guide or engine. These evolve independently. A published draft remains a work in progress.
- SHA-256 fingerprint
- A value calculated from bytes to verify their identity. It establishes neither authorship authenticity, collection completeness nor content truth.
02 / Choose evidence
Three profiles.
Different access.
TSEP-2 · 29 controls
With webmaster tools
Add evidence from the target engine’s tools. In this version, TS08 and TS12 concern Google Search Console; equivalence with another engine is not implied.
TSEP-3 · 44 controls
With internal data
Extend to logs, configuration, inventories, change history and CI output. Choose this scope when that access and the responsible people are available.
Choose according to accessible evidence and the question being asked. A profile is neither a certification nor a quality score.
Explore controls by profile →03 / The reference
A meaning.
A version.
This glossary supports reading; exact applicability and outcome conditions remain those of the controls and rules in the selected version.
Read the normative source · v0.3.0-draft.9 ↗
Cite this version and report an outcome →