Providing security assurance relies on programs, schemes and assessors specifying and performing appropriate measurements. These may include sampling strategies, specification of appropriate boundaries and the rigor of assessment. Confidence in the security assurance claims depends on the conformity of assessments and appropriate measurement of the specification of the assurance requirements.