Risk
RAG band
Red, amber or green, applied to a score by fixed thresholds and then constrained by rules that move the band without altering the number.
Currentengine 9.0.0Verified 2026-08-30
The thresholds
| Band | Score |
|---|---|
| Green | 80 and above |
| Amber | 60 to 79.9 |
| Red | Below 60 |
Applied to each scored domain and to the overall score.
Three rules act on the band, not the score
| Rule | Effect |
|---|---|
| Critical ceiling | Green requires zero failing critical controls; five or more force red |
| Overall RAG floor | The overall band can never be better than the security band |
| Confidence gate | Below High confidence the overall band is withheld entirely |
Why they act on the band
So the arithmetic stays inspectable. A reader recomputing from the methodology page gets the score the pack prints. Had the ceiling adjusted the number instead, the published weights would no longer describe the calculation performed.
Not assessed
A domain that could not be scored has no band. It is not amber, not grey, and not a silent pass.
What it does not mean
A band is a threshold, not a risk appetite judgement. Green does not mean acceptable to your board; it means above 80 with no failing critical controls.