Risk & Scoring
The overall score and its weights
A weighted mean of the three scored domains, calculated only when all three were scored, so the published weights always describe the sum performed.
The weights
| Domain | Weight |
|---|---|
| Security | 0.5 |
| Resilience | 0.3 |
| Cost | 0.2 |
No silent renormalisation
The overall score is calculated only when every offered domain has been scored. If one was not, the overall rating is withheld rather than re-based across the remainder.
This is the rule that keeps the published weights honest. Re-basing across two domains would mean the pack printed weights of 0.5, 0.3 and 0.2 while performing a calculation that used none of them, and a reader recomputing from the methodology page would get a different answer from the cover.
Then the band is constrained
| Rule | Effect |
|---|---|
| Overall RAG floor | The overall band can never be better than the security band |
| Critical ceiling | Green requires zero failing critical controls; five or more force red |
| Confidence gate | Below High confidence the rating is withheld entirely |
All three act on the band, never the number.
What the pack prints
The overall score, the overall band, each domain score and band, the weights, and whether the critical ceiling was applied. Everything needed to check the arithmetic.