Risk & Scoring
RAG bands and risk levels
The thresholds that turn a score into a band, the floor the overall band cannot rise above, and the gate that withholds it entirely.
The thresholds
| Band | Score |
|---|---|
| Green | 80 and above |
| Amber | 60 to 79.9 |
| Red | Below 60 |
Applied to each scored domain, and to the overall score.
Three things can change the band without changing the score
| Rule | Effect |
|---|---|
| Critical ceiling | Green requires zero failing critical controls. Five or more force red |
| Overall RAG floor | The overall band can never be better than the security band |
| Confidence gate | Below High confidence the overall band is withheld entirely and reported as insufficient evidence |
Each acts on the band, never on the number. The arithmetic stays inspectable, and a reader recomputing from the methodology page gets the score the pack prints.
Why the floor exists
A green overall rating sitting above an amber security rating is arithmetically defensible and governance nonsense. Security carries the largest weight and the most consequence; the overall position cannot be better than it.
Not assessed
A domain that could not be scored has no band. It is reported as not assessed with its population stated, and it withholds the overall rating rather than being treated as zero. See Not assessed is not zero.