Scoring
Overall score
The weighted mean of the three scored domains, calculated only when all three were scored and then constrained by three separate band rules.
Currentengine 9.0.0Verified 2026-08-30
What it is
The weighted mean of the security, resilience and cost domain scores, using 0.5, 0.3 and 0.2.
When it is calculated
Only when every offered domain has been scored. Otherwise it is withheld.
What constrains its band
| Rule | Effect |
|---|---|
| Overall RAG floor | Never better than the security band |
| Critical ceiling | Green needs zero failing critical controls; five or more force red |
| Confidence gate | Withheld entirely below High confidence |
Why the number stays untouched
All three rules act on the band. The score remains the weighted mean, so a reader can recompute it from the methodology page and get the printed figure.
Where a rule moved the band, the pack states it. A score of 78 beside a red band is explained, not an error.
What it does not mean
Not a certification, not a comparison against anyone else, and not a measure of business risk.