Movahedi Solutions
NIST CSF Matrix Self-Assessment
This document is a self-assessment by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is not an audit, not a certification, and not a third-party verification. It is the concise one-page matrix version of the same assessment as the narrative Cybersecurity Self-Assessment, on the same evidence. For full narrative detail, read the companion document. For a concise record, read this matrix.
This document is a self-assessment. It is not a certification, not an audit, and not a third-party verification. 18 rows across 6 functions: Govern 3, Identify 3, Protect 4, Detect 2, Respond 3, Recover 3. Status: Verified 13, Partially verified 5. Header scan labelled exactly as a header scan, A+, October 28, 2026, at 00:59 UTC, never a penetration test.
This document is a self-assessment by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is not an audit, not a certification, and not a third-party verification.
Company: 1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada.
Contact: mohammad@movahedi.ca
Date: October 28, 2026
Framework: NIST Cybersecurity Framework 2.0, functions Govern, Identify, Protect, Detect, Respond, Recover.
Scope: the public website movahedi.ca, and the handling of client material in engagements. This document does not cover a client system.
How this document differs from the companion assessment
The companion document, Cybersecurity Self-Assessment: NIST Cybersecurity Framework, dated October 28, 2026, in this Trust Center set, is a narrative assessment: one section per function, describing practice in full sentences. This document is a concise matrix version of the same assessment. It states each item in one row, with a status and an evidence note, so a reader can scan all six functions on one page. Where the two documents differ in wording, the evidence cited is the same, and neither document claims more than the other. For full narrative detail, read the companion document. For a concise record, read this matrix.
Status key: Verified means the practice was checked on the date shown or in the companion document cited. Partially verified means part of the item is verified and the remainder is confirmed per engagement, as the row states. Items not listed here are not claimed.
Matrix
| Function | Item | Status | Evidence |
|---|---|---|---|
| Govern | Accountability for the public site and for engagement handling rules rests with the founder | Verified | Companion cybersecurity self-assessment, Govern section |
| Govern | Engagement handling rules are stated in writing for each engagement | Verified | Companion cybersecurity self-assessment, Govern section |
| Govern | A contact point for security questions is published | Verified | mohammad@movahedi.ca, stated on the Security Practices page |
| Identify | Public site scope is defined: one public site, built and deployed from GitHub | Verified | Companion cybersecurity self-assessment, Identify section |
| Identify | Each engagement names its systems, data flows, and deliverables in writing before dependent work begins | Verified | Companion cybersecurity self-assessment, Identify section |
| Identify | The firm helps a client identify its own assets and risks where that is the service engaged | Partially verified | Service scope confirmed per engagement; the service list is stated in the companion document |
| Protect | Public site served over HTTPS through Cloudflare | Verified | DNS and SSL Checks, October 28, 2026; SSL Labs grade A, assessed October 28, 2026, 01:00:26 UTC |
| Protect | Security headers in place on the public site | Verified | Security Headers scan, October 28, 2026; see Security Practices for the result. This is a header scan, not a penetration test |
| Protect | Client data used only for its engagement, access limited, removed at the end or returned or deleted on client instruction | Verified | Companion cybersecurity self-assessment, Protect section |
| Protect | Email authentication records published for the firm's domain | Verified | SPF, DKIM for the Google selector, and DMARC at quarantine policy, verified from DNS October 28, 2026; see DNS and SSL Checks |
| Detect | A change to the live site can be traced to its GitHub source | Verified | Companion cybersecurity self-assessment, Detect section |
| Detect | Material outside an engagement's scope can be spotted against the engagement record and raised with the client | Partially verified | Engagement record confirmed per engagement; no monitoring platform is claimed |
| Respond | A confirmed issue on the public site is handled through the site source and redeployment | Verified | Companion cybersecurity self-assessment, Respond section |
| Respond | A confirmed issue with client material is raised with the client and the handling step is agreed for that engagement | Partially verified | Response contact and handling step confirmed per engagement; no response time is claimed |
| Respond | Reports about the public site can be sent to a published contact, under published scope | Verified | mohammad@movahedi.ca; Responsible Disclosure page, scope movahedi.ca only |
| Recover | The public site can be redeployed from GitHub after a correction | Verified | Companion cybersecurity self-assessment, Recover section |
| Recover | An engagement is closed with the agreed handling step for client material completed and the record updated | Partially verified | Recovery step confirmed per engagement; no recovery time is claimed |
| Recover | A client program, where that is the service engaged, records the incident, actions taken, and next review point | Partially verified | Service scope confirmed per engagement |
Summary
Rows: 18, across 6 functions. Govern, 3; Identify, 3; Protect, 4; Detect, 2; Respond, 3; Recover, 3.
Status count: Verified, 13; Partially verified, 5.
Evidence links: https://securityheaders.com/?q=https://movahedi.ca&followRedirects=on https://www.ssllabs.com/ssltest/analyze.html?d=movahedi.ca
Limits: this matrix does not claim a company certification, a penetration test, a monitoring platform, a response time, a recovery time, or an availability figure. It does not cover a client system.
Related pages
Scope and limits, stated briefly
Where a matter is to be confirmed per engagement, it is stated as such, and it is confirmed in writing for that engagement before work starts. Contact: mohammad@movahedi.ca.