Verification
Verify a score
Recompute the result from the constants the pack prints, and confirm each gate and ceiling was applied where the pack says it was.
Every constant needed is printed on the pack's own methodology page. Nothing has to be requested.
Recompute the domain scores
Security. A weighted pass rate over distinct controls: critical 10, high 6, medium 3. Then subtract the posture penalties the pack states were applied.
Resilience. The mean coverage across signals that had in-scope resources. Each signal is printed with its numerator and denominator.
Cost. Waste as a proportion of spend, converted to a penalty using the multiplier the pack prints. Both figures are stated.
Recompute the overall
The weighted mean, using 0.5, 0.3 and 0.2. If any domain is unscored, the overall should be withheld, not re-based. Confirm it is.
Check the band, separately from the score
The band is not simply the score against the thresholds. Three rules act on it:
| Confirm | By checking |
|---|---|
| Overall band is not better than the security band | Compare the two |
| Green only with zero failing critical controls | Read the critical count |
| Red where five or more critical controls fail | Read the same count |
Where the ceiling was applied, the pack states it. A score of 78 beside a red band is explained, not an error.
Check the gates
- Minimum population. 25 controls, 5 resources, 100 US dollars of spend. A domain rated below any of these would be a defect
- Confidence. High requires three scored governance domains including security. Below that the overall rating should be withheld entirely
Check the arithmetic is inspectable
The number should never have been adjusted by a ceiling. Ceilings move bands. If a score looks as though it was reduced to fit a band, that is worth raising.