How scoring works

Rubric 2.1 separates measured public configuration from self-reported business controls. Neither is a complete security audit.

External configuration

Each applicable public control is passed, failed, unknown, or not applicable. Only passed and failed checks enter the score. Unknown checks reduce coverage. A score requires at least four measured outcomes and at least 60% coverage.

The score is the percentage of passed control weight among all measured control weight. Website availability, validated TLS, and DMARC policy have weight 3. Inbound email routing, SPF, and authoritative DNS consistency have weight 2. Other measured controls have weight 1. Control results and evidence are visible in each report.

Business readiness

Questions measure real controls across Communication, Information, Security, Operations, Continuity, Control, and Intelligence. Yes earns one point, No earns zero, and Not sure remains unknown. Context such as company size, vendor choice, CMS, or having an MSP earns no points.

A category is rated when at least half its applicable controls have definite answers. An overall readiness score requires all seven categories to be rated and at least 70% of applicable controls to have definite answers. Categories are weighted equally. Results are labeled self-reported until independently reviewed.

Comparing assessments

Use the same rubric and comparable coverage when comparing results. Different checks or unavailable sources can change coverage. A change in score is not proof of compromise, compliance, or a particular financial outcome. Compare scores only within the same rubric version. Rubric 2.1 adds the published content security policy check and excludes form checks where no static forms or fields were sampled. A lower score after a rubric change does not mean the business deteriorated.

Limits that matter

Published DKIM keys do not establish actual signing. Certificate names do not establish asset ownership. A public website response does not establish backups, MFA, patching, or administrator recovery. Automated page diagnostics do not establish full accessibility.