Scoring & Calculation

Metrics

Exactly how a score is calculated, what each band means, and how to read your result - all the scoring mechanics in one place.

76%

How the score is calculated (methodology 2.0)

Every answer resolves to one status: in place, partly in place, not in place, not sure, not applicable, or not asked (Quick screening). Only the first three are graded: in place earns 2 points, partly 1, not in place 0.

Coverage is the points earned divided by the points possible over the controls you answered definitely, with each control weighted by importance - 3 for critical controls, 2 for high-impact, 1 for standard. It is computed across all controls at once, not averaged across the six areas. Completeness is how many applicable questions have a definite answer. "Not sure" never counts as "No": it is excluded from coverage and listed as something to confirm.

Setup answers that describe a control - network segmentation, DevSecOps gates, secrets handling, container and hypervisor hardening, OT segregation and monitoring - are scored like any other control. Combined findings (risky combinations of answers) and the risk ranking are explained on the Methodology page. The methodology version is recorded on every report, and History only compares reports made with the same version and mode.

Reading your score

The reading is decided by rules in a fixed order, and the percentage only matters once the earlier rules pass: any critical gap gives Critical gaps found; otherwise an unverified critical control gives Verification needed; otherwise fewer than 60% definite answers gives Incomplete picture; only then do the coverage bands apply. Quick screening never gives a band - it reports critical gaps or "No critical gaps in this screening".

below 40%
High exposure
40–64%
Elevated exposure
65–84%
Moderate exposure
85% or more
Strong foundations

What each reading means

In the order they are checked. For how each phase of the Maturity Model connects to this, see that page directly.

Any coverage
Critical gaps found
Good bitsOften plenty - many organizations here have most controls in place. The reading is about what is missing, not how much is present.
Bad bitsAt least one critical control is not in place: MFA (or MFA for admins only while internet-reachable), internet-exposed remote admin, no endpoint protection, ad hoc patching with internet exposure, shared privileged accounts, backups that are not isolated or never restore-tested, or a flat or unsecured OT network.
Why this numberEach of these can decide on its own whether an attack succeeds or whether you can recover - the CISA Performance Goals and #StopRansomware guidance put them first for that reason.
PriorityClose the critical gaps first; they are all in the 30-day group of the action plan.
Any coverage
Verification needed
Good bitsNo critical control is known to be missing.
Bad bitsAt least one critical control was answered "Not sure".
Why this numberAn unverified critical control is a real risk, just a smaller one than a confirmed gap - so it is ranked as something to confirm, not scored as a failure.
PriorityFind out - the action plan lists each one as "Find out: ...", with a 30-day target.
Completeness under 60%
Incomplete picture
Good bitsWhatever was answered is scored normally.
Bad bitsFewer than 60% of applicable questions have a definite answer.
Why this number"Not sure" and unanswered questions are excluded from coverage rather than counted as "No", so a high percentage built on a few answers would be misleading.
PriorityFill in the unknowns, then read the percentage.
Coverage below 40%
High exposure
Good bitsNo single critical gap was found.
Bad bitsMost controls are missing or partial.
Why this numberCoverage weights critical controls 3x and high-impact controls 2x, so a low figure means important controls, not just paperwork, are absent.
PriorityWork down the action plan in order; it is ranked by risk, not by questionnaire order.
Coverage 40-64%
Elevated exposure
Good bitsBaseline controls exist without a critical gap.
Bad bitsMany controls are missing or partial - often detection, response testing and governance.
Why this numberPartial answers count half; missing ones count zero, weighted by importance.
PriorityThe 60-day group of the action plan is usually where the biggest gains are.
Coverage 65-84%
Moderate exposure
Good bitsMost controls are in place and no critical control is missing.
Bad bitsSeveral important controls are still missing or partial.
Why this numberThe remaining gaps are real but no longer the kind that most often decide an incident on their own.
PriorityFinish the high-impact items and start testing what is in place (restore drills, tabletop exercises).
Coverage 85% or more
Strong foundations
Good bitsCore controls are in place, no critical gap, and at least 60% of questions have definite answers.
Bad bitsCombined findings and the remaining standard items still matter, and self-reported answers can be optimistic.
Why this numberEarned by definite answers - not by leaving hard questions unanswered.
PriorityVerify that controls work as described, and re-assess after significant changes.

How this site tracks it over time

Completed assessments are saved in your browser (if it allows storage). Your next report shows what changed since the previous one made with the same methodology and mode: the coverage change, and which findings were resolved or are new. Reports from an earlier methodology are kept, labelled, and not compared directly.

View assessment history → Start an assessment →