This site has no accounts, no forms, no advertising, and sets no cookies. It stores up to two preferences in your browser's local storage: which of the sixteen decisions you have already opened, so the instrument can mark them as seen, and, if you type it in, your federal contract's yearly value, so the instrument can show what a month of waiting is worth to you. Both values stay on your device and are never sent to us. Clearing your browser's site data removes them.
On the scan page, after your file is read in your browser, the page sends us one short line: which scanner made the file, how many findings it had, and how many the engine could draft for. It has no file contents, no file names, and nothing about you. We use it to know the page is being used. It also carries a random run number so we can match the start and the end of one run; it is not about you.
When you email us, we keep the correspondence for as long as needed to respond and to keep a record of the engagement. We do not sell or share personal information, and we do not use it for advertising. Our email provider processes it on our behalf.
You may ask what personal information we hold about you, ask us to correct or delete it, or object to its use, by writing to info@gomessecurity.com. We answer within 45 days. Because the site does not track visitors, there is no tracking to opt out of; Global Privacy Control signals are honored by default.
This site is for businesses and is not directed to anyone under 16. We do not knowingly collect information from children.
Changes to this policy are posted here with a new date above.
By using this site you agree to these terms. If you do not agree, do not use the site.
The site is for general information. Nothing on it is legal, audit, assessment, or compliance advice, and reading it creates no engagement or client relationship with Gomes Security LLC. Authorization decisions belong to you, your assessor, and your authorizing official.
Dollar figures, likelihoods, rankings, propagation counts, and forecasts on the instrument are computed estimates derived from the public sources listed on the Sources page under stated assumptions. They describe averages and ranges, not your outcome, and are not guarantees. The running scenarios are illustrative: every rule, clock, and number is real; the people and companies are staged.
The site, the instrument, its text, and its computed outputs are the property of Gomes Security LLC and protected by copyright and other laws. You may view the site, link to it, and quote brief passages with attribution. You may not copy, scrape, reproduce, or redistribute the instrument or its data, or use them to build a competing product, without written permission.
Research reports, standards, and mapping data are cited, not reproduced; each remains the property of its publisher and is subject to its own terms. Gomes Security LLC is not affiliated with, sponsored by, or endorsed by the U.S. General Services Administration, the FedRAMP program, NIST, The MITRE Corporation, or any publisher cited on this site.
The site is provided “as is” and “as available” without warranties of any kind, express or implied, including accuracy, completeness, fitness for a particular purpose, and non-infringement. Source figures change as publishers issue new editions; the site states the edition it relies on.
To the fullest extent permitted by law, Gomes Security LLC is not liable for any indirect, incidental, consequential, or punitive damages, or for any loss of profits, data, or business, arising from use of the site. Our total liability for any claim relating to the site will not exceed one hundred U.S. dollars ($100).
These terms are governed by the laws of the Commonwealth of Virginia, without regard to its conflict-of-law rules. Disputes are brought in the state or federal courts located in Virginia.
We may update these terms; the current version is always posted here with its date. Questions: info@gomessecurity.com.
The Fix Engine page reads a scanner export you choose in your browser. The file is not uploaded. After it runs, the page sends us one short line with the scanner name and the counts, as the privacy section says. Nothing on that page is legal, audit or compliance advice.
Gomes Security LLC aims to meet WCAG 2.2 Level AA across this site. The interactive instrument on the home page is drawn on an HTML canvas, which screen readers cannot read directly. The same content is available as text: each decision's full card, and the Sources page, carry every figure the instrument shows. The site honors your operating system's reduced-motion setting.
If any part of this site is not accessible to you, email info@gomessecurity.com and we will provide the content in a format that works for you.
GOMESSECURITY™, GS|ATO™, and Compliance-as-Architecture™ are trademarks of Gomes Security LLC. FedRAMP is a mark of the U.S. General Services Administration. ATT&CK is a mark of The MITRE Corporation. IBM, Verizon, Mandiant, CrowdStrike, Sophos, and all other names are the property of their respective owners, and their use here is nominative: it identifies the cited source and implies no affiliation or endorsement.