Cybersecurity Compliance Research & Benchmark Data | Lazarus Alliance

Lazarus Alliance Research publishes original cybersecurity audit, assessment, and compliance intelligence derived from aggregate, anonymized engagement data. Research covers CMMC, FedRAMP, SOC examinations, ISO certification, and related cybersecurity and governance frameworks. Reports are designed to provide security leaders, government contractors, compliance professionals, researchers, and journalists with evidence-based benchmarks drawn from real-world assessment experience.

Coming Soon

• 2026 ISO 27001 Certification Benchmark Report
• 2026 NIST 800-53 Assessment Benchmark Report

2026 Research Reports

• 2026 CMMC Assessment Benchmark Report
• 2026 FedRAMP Assessment Benchmark Report
• 2026 SOC 2 Assessment Benchmark Report
• 2026 CJIS Assessment Benchmark Report
• 2026 LA DMF Assessment Benchmark Report

Frequently Asked Questions

Research Methodology & Editorial Standards

• Dataset Inclusion and Exclusion Rules

  Dataset Inclusion and Exclusion Rules. Lazarus Alliance Research datasets are derived from completed professional assessment engagements that meet the defined scope, framework, assessment type, and reporting period established for each study. Records are included only when sufficient engagement data exists to support the measurements being reported and the engagement meets the study's stated eligibility criteria. Readiness reviews, consulting engagements, incomplete or cancelled assessments, duplicate records, test data, and engagements lacking sufficient information for the applicable analysis are excluded unless a specific research publication expressly states otherwise. Each benchmark report identifies its population, sample size, observation period, and any additional inclusion or exclusion criteria so readers can understand the population represented by the findings.

• Anonymization Methodology

  Anonymization Methodology. Lazarus Alliance Research is designed to produce useful industry benchmarks without disclosing confidential client information. Research datasets are de-identified before analysis and publication by removing or suppressing client names, personnel names, system names, contract identifiers, IP addresses, account information, proprietary artifacts, and other information that could directly identify an assessed organization or its environment. Findings are reported in aggregate wherever practicable, and potentially identifying combinations of characteristics may be generalized, grouped, or omitted. Lazarus Alliance does not publish client-specific assessment findings or confidential evidence through its research program unless disclosure has been expressly authorized.

• Statistical Methodology

  Statistical Methodology. Lazarus Alliance Research uses descriptive statistical methods appropriate to the size, characteristics, and completeness of each dataset. Published analyses may include counts, percentages, distributions, medians, ranges, and other summary measures calculated from the eligible observations available for a particular metric. Denominators are identified where they differ from the overall study population, and missing or inapplicable observations are not automatically treated as negative findings. Results describe the observed dataset and should not be interpreted as guaranteed outcomes, causal relationships, or statistically representative of every organization subject to the applicable framework. Where sample size or data limitations materially affect interpretation, those limitations are disclosed with the research.

• Publication and Version Policy

  Publication and Version Policy. Lazarus Alliance Research publications are dated and maintained as versioned research resources so readers can distinguish historical findings from subsequent updates. Material revisions to datasets, methodology, regulatory context, calculations, or conclusions are reflected through an updated publication or revision date and, where appropriate, explanatory revision notes. Minor editorial changes that do not alter the meaning of the research may be made without issuing a new research version. When regulatory requirements change after publication, Lazarus Alliance may update explanatory material while preserving the historical context and observation period of the underlying dataset rather than retroactively treating historical assessments as though they occurred under newer requirements.

• Correction Policy

  Correction Policy. Lazarus Alliance is committed to correcting material factual, analytical, attribution, or presentation errors identified in its published research. Reported issues are evaluated against the underlying dataset, engagement records, applicable authoritative sources, and publication methodology. When an error could materially affect interpretation of a finding, Lazarus Alliance will correct the publication and, where appropriate, identify the nature or date of the correction. Corrections are intended to improve the accuracy of the research without obscuring the historical record. Changes in regulations, standards, or government guidance occurring after publication are distinguished from errors in the original research.

• Regulatory-Source Hierarchy

  Regulatory-Source Hierarchy. Regulatory and compliance statements in Lazarus Alliance Research are grounded in authoritative primary sources whenever available. Priority is given to enacted statutes and regulations, official government publications and program requirements, controlling contract clauses, and standards or normative publications issued by the organization responsible for the applicable framework. Official implementation guidance, FAQs, program notices, and recognized accreditation or certification authorities are used as secondary interpretive sources where appropriate. Industry commentary, news reporting, vendor materials, and other third-party sources may provide context but are not treated as controlling authority when a primary source is available. When authoritative sources conflict or requirements are undergoing transition, the publication identifies the uncertainty rather than presenting an interpretation as settled fact.

• Editorial Evidence Standard

  Editorial Evidence Standard. Material factual claims published by Lazarus Alliance Research must be supported by an identifiable evidentiary basis. Quantitative claims derived from Lazarus Alliance data must be traceable to the applicable dataset and accompanied by sufficient context to understand the sample, period, denominator, methodology, and relevant limitations. Regulatory and technical requirements must be supported by authoritative sources and must distinguish mandatory requirements from recommendations, interpretations, and professional observations. Client outcomes, performance improvements, cost reductions, timelines, comparative claims, and similar assertions are not presented as general facts unless adequate evidence supports them. Claims that cannot be adequately substantiated are qualified, attributed, identified as estimates or professional observations, or removed.

• Author and Reviewer Qualifications

  Author and Reviewer Qualifications. Lazarus Alliance Research is prepared and reviewed by cybersecurity, risk, privacy, audit, and compliance professionals with experience relevant to the subject matter of each publication. Depending on the research topic, contributors may include Cybervisors®, independent assessors, auditors, technical specialists, and professionals experienced with the applicable regulatory or standards environment. Publications involving specialized frameworks are subject to technical review by personnel familiar with the relevant assessment requirements and authoritative sources. Author and reviewer credentials are presented where appropriate to help readers evaluate subject-matter expertise, while editorial and technical review does not replace the reader's responsibility to evaluate requirements applicable to a particular organization.

• Conflict of Interest and Independence

  Conflict of Interest and Independence Statement. Lazarus Alliance conducts research in a manner intended to preserve the professional independence, objectivity, confidentiality, and impartiality required of its assessment activities. Research findings are not altered to favor a client, technology provider, commercial product, or desired marketing outcome, and commercial considerations do not determine whether an observed result is included in an eligible research dataset. Client information obtained through assessment engagements remains subject to applicable confidentiality and independence requirements. Where Lazarus Alliance performs independent third-party assessments, research, publications, advisory activities, and commercial relationships are managed so they do not impair the independence or impartiality required by the applicable accreditation, assessment program, professional standard, or contractual obligation.

Talk with one of our experts

Our Lazarus Alliance Cybervisor™ teams have experience performing thousands of assessments for organizations providing services to clients around the world.

We're here to answer any questions you may have.