Methodology
How we rate sources
Every source belongs to one of three tiers. The tier says who is publishing — it is not a judgement of whether a single article is right.
Official
Regulators, standards bodies and government agencies publishing primary sources.
Examples: HHS Office for Civil Rights, the EDPB, the UK ICO, NIST, the PCI Security Standards Council, the EBA and ESMA, the California Privacy Protection Agency.
Trade press
Specialist compliance, legal and security publications reporting on the event.
Examples: Specialist outlets such as HIPAA Journal, Infosecurity Magazine, Dark Reading, SecurityWeek and law-firm data protection blogs.
Community
Blogs, forums and reader submissions. Always reviewed by a moderator first.
Examples: Independent blogs, vendor research and stories submitted by members.
Coverage bars
Each story shows how many of its sources fall into each tier. This story, for example, was reported by one regulator and two trade publications:
- Official
- 1 (33%)
- Trade press
- 2 (67%)
- Community
- 0 (0%)
Only sources we have actually linked to the story are counted. Links that stop working are removed from the count automatically.
Headlines
A story’s headline comes from its most authoritative source. If a trade publication reports an event first and the regulator publishes later, the headline switches to the regulator’s.
Moderation
Stories our classifier is less sure about, and every community submission, wait for a moderator before they are published.