Scoring
Population minimums
The floors below which a domain is reported rather than rated, because a score over a trivial population states nothing about governance.
The floors
| Domain | Minimum |
|---|---|
| Security | 25 evaluated controls |
| Resilience | 5 distinct applicable resources, counted per family |
| Cost | 100 US dollars of observed 30-day spend |
What happens below them
The domain is reported as not assessed, with the population stated. Everything observed is still printed with its denominator.
Why each exists
Security. Below 25 evaluated controls the scanner's output cannot support a governance conclusion.
Resilience. One database with backups is not a resilience posture. Counting per family stops one service satisfying the minimum twice.
Cost. An account spending eight dollars a month scored full marks because it had no idle resources to waste. True, and useless.
It is a rating gate, not a reporting gate
Being below the minimum suppresses the rating, not the evidence. What is withheld is the claim that a measurement was made.
What it does not mean
A domain below the minimum has not passed and has not failed.