Controls
Control pass rate
The proportion of evaluated controls that passed, weighted by severity. It requires both outcomes and cannot be computed from failures alone.
What it is
The weighted proportion of distinct controls that passed, out of those evaluated.
Why both halves are required
A rate needs a denominator. Without passing results the domain is reported as not assessed rather than scored, because a count of failures on its own says nothing about proportion.
How GovIntel applies it
Each control is weighted by severity. Records that cannot be classified are excluded from both the numerator and the denominator, and the excluded count is reported.
Why a pass rate rather than a penalty model
A penalty model has no natural ceiling and no natural denominator, so its output is not comparable between accounts or between assessments. A rate is.
What it does not mean
A high pass rate is not a green rating. The critical ceiling can hold a band below what the rate alone would produce, because a board does not ask what proportion of controls passed.