Risk & Scoring
Minimum population
A domain measured over a trivially small population states nothing about governance, so below these thresholds no rating is issued.
The thresholds
| Domain | Minimum |
|---|---|
| Security | 25 evaluated controls |
| Resilience | 5 distinct applicable resources, counted per family |
| Cost | 100 US dollars of observed 30-day spend |
Below the threshold, the domain is reported as not assessed with its population stated. The observations are still printed.
Why each exists
Security. One versioned control result is not evidence of security governance. Below 25 evaluated controls the scanner's output stops being able to support a governance conclusion at all.
Resilience. One database with backups enabled is not a resilience posture. The minimum is counted per resource family so a single service cannot satisfy it twice.
Cost. An account spending eight dollars a month scored 100 and green, because it had no idle resources to waste. True, and useless: there is nothing at that scale for cost efficiency to be a statement about.
It is a rating gate, not a reporting gate
The population being below the minimum does not suppress the evidence. Everything observed is still reported, with the denominator visible. What is withheld is the rating, because a rating implies a measurement the population cannot support.