Scoring
Overall RAG floor
The rule that stops an overall band being better than the security band, whatever the weighted arithmetic would otherwise produce.
What it is
The overall band can never be better than the security domain band.
Why
Security carries half the weight, and strong resilience and cost scores can arithmetically lift an overall band above a poor security one.
A green overall rating sitting above an amber security rating is defensible arithmetic and governance nonsense. No board reading a pack would accept the composite as the headline once they saw the security row beneath it.
How it is applied
To the band, not the score. The overall number remains the weighted mean, so the calculation stays reproducible.
What it does not mean
The floor does not raise a band. It only prevents one rising above security. A poor resilience score still drags the composite down through the weights in the normal way.