Open framework · v1.2 public draft
Your organisation has a Trust Surface.
People experience your organisation through domains, email, identity, digital services, platforms, and third parties. Those systems create trust-relevant conditions that can be assessed using attributable evidence.
TrustSurface provides a structured way to identify that surface, assess its Trust Signals, understand Digital Trust Posture, and integrate the result into governance.
Why this exists
Security posture and Digital Trust Posture answer different questions.
An organisation can invest heavily in internal security while trust-relevant conditions at its digital edge remain weak, inconsistent, or poorly governed. That mismatch is where the Trust Signal Gap becomes visible.
Consider email: a mature security program does not by itself show whether a primary domain can be impersonated, whether authorised senders are understood, or whether current evidence supports a strong email-integrity assessment.
TrustSurface makes those conditions assessable without treating outward appearance as proof of internal control.
The mechanism
Move from digital systems to an evidence-backed posture view.
TrustSurface separates what exists, what is being assessed, the evidence used to assess it, and the resulting posture judgement.
- 01 Systems and dependencies Define the scoped Trust Surface: the services, domains, platforms, relationships, and boundaries that matter.
- 02 Trust Signals Select defined trust-relevant properties, behaviours, or conditions of Trust Surface components or relationships to assess for a defined target.
- 03 Evidence Gather attributable external, internal, operational, or governance evidence that supports the assessment.
- 04 Assessment Record the result, confidence, freshness, and limitations rather than collapsing evidence into unsupported assurance.
- 05 Digital Trust Posture Use the evidence-backed assessment set to understand posture, prioritise action, and support governance decisions.
The framework
Six domains organise the Trust Surface.
They provide consistent analytical and governance views across the digital environment. Real systems and dependencies may span more than one domain.
Identity
Authentication, federation, and access governance.
Domains and DNS
Registration, resolution, naming integrity, and control.
Email Integrity
Authenticity, alignment, transport integrity, and sender governance.
Digital Services
Websites, portals, APIs, and service interfaces.
Infrastructure and Platforms
Hosting, resilience, platforms, and operational foundations.
Third-Party Ecosystem
Vendor governance, integrations, dependencies, and delegated trust.
Operating rhythm
Discover → Assess → Harden → Govern → Signal
The lifecycle turns posture assessment into a repeatable practice: define the surface, assess Trust Signals using Evidence, address weak or partial outcomes, integrate decisions into governance, and communicate supportable trust information.