Research & Publication Roadmap

Five credibility milestones from methodology engineering through ISACA publication

Arthur Sr. · 2026-07-10 02:00

Build the CRI Assessor → Publish a paper.

Conduct a research program whose final deliverable is both a published paper and a mature methodology.

This roadmap doesn't say Authentication, Dashboard, Reports, API. It says Stability, Validation, Repeatability, Independent Review, Real-World Pilot, Publication. That's not a product roadmap. That's evidence. And evidence is exactly what persuades auditors, regulators, and ISACA reviewers.

✓

Milestone 1

Can it work?

Complete

Profile Engineering Specification
Compatibility Reasoning Specification
Coverage Assessment Methodology
Coverage Decision Record
Human Review Workflow
External Methodology Review (EMR-001)
Control Selection Specification

Milestone 2

Can it repeat?

In Progress

Three-run stability testing — 96–99% dimension stability, 86% full profile agreement
Gold standard — human-reviewed control profiles
Taxonomy validation round 1
Taxonomy validation round 2
Control selection validation
Compatibility validation
Coverage determination validation
Inter-rater agreement metrics

★

Milestone 3

Can professionals trust it?

Upcoming

Independent practitioner review
Second reviewer validation
External control library test

Critical credibility milestone. This is where the methodology transitions from “Arthur Labs believes…” to “Independent professionals reached substantially similar conclusions.”

Milestone 4

Can it survive reality?

Upcoming

Real client pilot
Production assessment
Client feedback

Milestone 5

Can the profession adopt it?

Upcoming

ISACA white paper
Conference presentation
Public website
Open methodology
Version 1.0 release

Research Phases

Foundation

✓ Profile Engineering Specification
✓ Compatibility Reasoning Specification
✓ Coverage Assessment Methodology
✓ Coverage Decision Record
✓ Human Review Workflow
✓ External Methodology Review (EMR)

Empirical Validation

✓ Three-run stability testing
☐ Gold standard — human-reviewed control profiles
☐ Taxonomy validation (rounds 1 & 2)
☐ Control selection validation
☐ Compatibility validation
☐ Coverage determination validation
☐ Inter-rater agreement metrics

Real World Validation

☐ Independent practitioner review
☐ Second reviewer validation
☐ External control library
☐ Real client pilot
☐ Production assessment
☐ Client feedback

Generalization

☐ Second CRI domain
☐ Five CRI domains
☐ Twenty CRI domains
☐ Complete 318 DS coverage
☐ Multi-framework assessment

Academic Support

☐ Literature review
☐ Related work
☐ Methodology limitations
☐ Threats to validity
☐ Statistical analysis
☐ Reproducibility package
☐ Public demonstration

Publication

☐ ISACA white paper
☐ Conference presentation
☐ Public website
☐ Open methodology
☐ Version 1.0 release

Why This Roadmap Is Different

Software Roadmap

Authentication
Dashboard
Reports
API
Mobile app

This Roadmap

Stability
Validation
Repeatability
Independent Review
Real-World Pilot
Publication

We're not building a product first. We're building evidence. And evidence is exactly what persuades auditors, regulators, and ISACA reviewers.

By the time the paper is submitted, nearly every major claim will be supported by empirical results rather than aspiration.

Framing for Practitioner Review

“We've completed the methodology engineering phase. The next phase is empirical validation with practitioners and real client environments.”

A practitioner joining now isn't joining halfway through software development. They're joining halfway through a research and validation program. That's a much more interesting proposition.