How the IT-security ranking is built: objective anchors, the analysts’ bounded role, thresholds, review rules and every formula version.