Frameworks and method
The readiness score
How the app computes the readiness of a framework, from the state of the controls.
The readiness score answers one question: what share of the applicable requirements is already held by controls in place? It is a measure of work, not a compliance grade.
In three steps
- Each control has a computed state, never typed (see below).
- Each requirement has a state, derived from the controls that cover it.
- Readiness is a weighted average of the states of the applicable requirements.
The state of a control
| State | Meaning |
|---|---|
| Not applicable | The control is left out of the statement. |
| Not implemented | It is not yet implemented. |
| Test failing | A measured test fails. This state takes precedence over missing evidence. |
| Evidence to provide | An expected piece of evidence is missing, or older than its frequency. |
| In place | Implemented, evidence up to date, no failing test. |
Stale evidence counts neither for the state, nor for the score, nor for the rule "no closing without evidence": the rule is the same everywhere.
The state of a requirement
Only the controls that cover the requirement count; those that contribute to it or are related to it do not enter the calculation, and not-applicable controls are ignored.
| State | When |
|---|---|
| Met (1) | At least one control covers the requirement, and all are in place. |
| Half (0.5) | At least one control is in place; or every control is implemented but waits for evidence (the half credit: "evidence to provide"). A control with a failing test never gives the half credit. |
| Not met (0) | Controls cover the requirement, but none of the cases above applies. |
| No control (0) | No control of the catalog covers it: a hole in the catalog, counted as not met. |
| Not applicable | Every control covering it is not applicable, or the requirement is excluded from your scope. |
The calculation
The readiness of a framework is:
round( 100 × (met + 0.5 × half) ÷ applicable )
It is 0 when nothing applies. Overall readiness is computed over all the applicable requirements of the active frameworks pooled: it is not the mean of the framework scores. A requirement covered by two frameworks counts once in each.
Good to know
This rule is version 2 of the score, the one based on common controls. The Frameworks page states the version in force.
What the score does not say
- It does not say a requirement is "compliant": a control "in place" means implemented with up-to-date evidence, not judged sufficient.
- It replaces neither the internal audit nor the certification audit.
Was this page helpful?