The Expert Reasoning Behind Every Feedora Question
From international standards and management best practices to real-world IT assessment experience
When an IT manager answers a question in an assessment system, it may at first seem like a simple prompt:
“Does the organization have a defined program for managing information technology risks?”
But have we ever asked where such a question comes from?
Who decided that this topic should be assessed? Why does risk management matter? What criteria define a desirable state? And how can we be sure that answering this question truly helps us understand the state of the organization’s IT?
These questions point to a fundamental issue that is usually invisible on the surface of assessment systems:
Before we look at its charts, scores, or reports, an assessment’s credibility depends on the reliability of its sources and the logic behind its questions.
A Simple Question, Backed by Knowledge and Experience
Imagine that the state of IT across 50 subsidiaries of a holding company is to be assessed.
If the questions are designed solely on the personal experience of a few specialists, what guarantee is there that every important dimension of information technology has been examined?
Might an important topic have been overlooked?
Might a less important topic have received disproportionate attention?
Would the results of such an assessment stand up in management meetings?
To meet this challenge, a professional assessment must be designed on the basis of credible sources, recognized frameworks, and a clear methodology.
This is precisely the perspective that shaped Feedora.
Feedora is a structured platform built on a specialist team’s experience assessing IT across organizations.
Over approximately 13 years, that work has spanned petrochemicals, oil and gas, energy, pharmaceuticals, cement, and other industrial sectors.
But practical experience is only one of the foundations on which Feedora is built.
The other foundation is the accumulated expert knowledge embedded in international IT standards, frameworks, and best practices.
When Global Knowledge Is Translated into Assessment Language
In the world of information technology, professional bodies and standards organizations have spent years formulating answers to important management and technical questions.
How should information technology be governed?
How should security risks be managed?
How should IT services be delivered and improved?
How should enterprise systems architecture be designed?
How should data be managed?
And how should organizations navigate digital transformation and the adoption of intelligent technologies?
The result of this work is a body of recognized standards and frameworks, each of which codifies part of the professional body of knowledge in IT.
In designing its assessment approach, Feedora draws on the concepts and principles of such sources.
COBIT: How Should Information Technology Be Governed?
The COBIT framework, developed by ISACA, is widely recognized for its guidance on the governance and management of enterprise information and technology.
It addresses topics such as aligning IT with business objectives, managing risk, using resources effectively, realizing benefits, and monitoring performance.
When an assessment asks about IT decision-making structures, responsibilities, policies, or how performance is overseen, COBIT concepts can provide valuable support for designing measurement criteria.
ITIL: How Should IT Services Be Managed?
ITIL is one of the best-known frameworks for IT service management.
It helps organizations structure their services around value creation, incident management, problem management, change management, request fulfillment, and continual improvement.
For that reason, assessing an IT support unit should not be limited to headcount or the tools in use; the quality of processes and the effectiveness of services should also be examined.
ISO/IEC 27001 and NIST CSF: Security Goes Beyond Buying Equipment
Information security is not limited to having a firewall, antivirus software, or security appliances.
ISO/IEC 27001 specifies requirements for an information security management system. The NIST CSF 2.0 provides a structured approach to cybersecurity through six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
These sources help organizations see security as a set of processes, responsibilities, controls, and organizational capabilities—not merely a list of purchased equipment.
TOGAF: Do Systems and Infrastructure Follow a Defined Architecture?
TOGAF is a recognized framework for enterprise architecture.
It helps organizations establish coherent links among business, data, application, and technology architectures.
When an organization has many systems, siloed information, or heterogeneous infrastructure, enterprise architecture concepts can be highly valuable for identifying gaps and examining future development paths.
DAMA-DMBOK: Data Is an Organizational Asset
In many organizations, data is generated, stored, and used in reports—but it is not necessarily managed properly.
The DAMA-DMBOK guide introduces a set of data management knowledge areas, from data governance and quality to architecture, security, metadata, and integration.
These concepts matter when assessing an organization’s readiness for data analytics, business intelligence, and the adoption of intelligent technologies.
This matters because, without trustworthy data, artificial intelligence cannot by itself support trustworthy decision-making.
Assessment Credibility Lies in the Right Combination of Sources
No single standard or framework can cover every dimension of an organization’s information technology.
COBIT focuses on governance and management.
ITIL addresses service management.
ISO/IEC 27001 and NIST CSF apply to security management and cyber risk.
TOGAF addresses enterprise architecture.
DAMA-DMBOK structures the knowledge of data management.
Other sources such as ISO 22301, ISO/IEC 20000-1, ISO/IEC 38500, and CMMI can also serve as a basis for designing assessment criteria in related domains.
The craft of designing a comprehensive assessment system is not simply listing these sources side by side; it is selecting, interpreting, and converting their relevant concepts into clear, measurable questions suited to organizational reality.
A good question should make clear what capability or control it measures, why that topic matters, and what evidence can show the organization’s actual state.
From Global Standards to the Reality of Iranian Organizations
International frameworks are valuable sources, but using them effectively requires an understanding of the organization’s real environment.
A petrochemical company differs from a bank, a service organization, or a pharmaceutical company in its mission, risk profile, and reliance on IT.
For that reason, turning international knowledge into a practical assessment system requires field experience and an understanding of organizational differences.
The Feedora team’s experience assessing IT across industries helps connect expert concepts with the practical challenges organizations face.
For example, service continuity in a manufacturing organization, security management in an organization handling sensitive information, and data integration in a large holding company should all be assessed in the context of the organization’s activities.
Standards tell us which topics matter; practical experience helps us understand how those topics should be examined in each organization.
Transparency of Sources: An Important Step Toward Trust in Assessment
One natural question IT managers ask when they encounter an assessment system is:
“What is the basis for this question?”
A credible answer should not be merely that “our specialists judged this question to be important.”
A professional assessment system should be able to explain the sources and expert rationale behind its questions.
For Feedora, this means making the link between assessment questions and their relevant expert sources clearer.
In this way, users can not only see the question but also become familiar with the standards, frameworks, and concepts that underpin that topic.
This approach creates two important forms of value.
First, it makes assessment criteria more transparent and defensible.
Second, the assessment process itself becomes an opportunity for managers and specialists to learn about recognized best practices.
Of course, referring to a source does not by itself mean that a question fully aligns with that source, or that the assessment is formally endorsed by the body that published it. The credibility of this link is strengthened when the mapping of questions to clauses, processes, and concepts in those sources is documented and reviewable.
Feedora: Where Knowledge, Experience, and Technology Meet
Feedora aims to bring three essential elements together in a coherent structure:
Specialist knowledge:
Drawing on the concepts of standards, international frameworks, and recognized IT best practices.
Practical experience:
Applying years of experience in assessing IT and diagnosing organizational IT weaknesses across industries.
Technology and analysis:
Turning assessment data into comparable results, analyzing trends, identifying weaknesses, and supporting management decisions.
This combination helps Feedora move assessment beyond a simple questionnaire and turn it into a structured process for understanding the state of information technology.
For a ministry or a holding company, such an approach is especially important.
When assessing IT across dozens of organizations and subsidiaries, managers need to trust the methodology, understand the basis for the findings, and use them to make decisions.
Closing: Trust a Score—or the Logic Behind It?
Suppose two assessment systems have examined the state of a company’s IT.
Both produce a score out of 100.
In one, it is unclear on what basis the questions were designed; in the other, the assessment logic, specialist sources, and measurement criteria can be explained.
Which result is more defensible for management decision-making?
The answer is clear.
The value of a score is not the number it displays; it depends on the quality of the questions, the credibility of the criteria, the evidence gathered, and the analysis method behind it.
Feedora is built on the belief that IT assessment should rest on credible knowledge, specialist experience, and a clear methodology.
When assessment results inform important management decisions, budget allocation, and IT project planning, subjective questions and unsupported analysis are not enough.
Feedora: Where IT assessment experience meets international knowledge and best practices.