How we score and why
Every question, score rule and fix in CyberPostura is listed in one register with the reason it is there and the standard behind it. This page shows what that register says today, including the parts that still rest on our own judgement.
Register last checked 30 Oct 2026. The scoring method is under review and may change.
What this is, and what it is not
- A self-assessment. Your score comes from your own answers. We do not check them unless you upload proof or we run an outside check.
- Not a certification. It does not replace Cyber Essentials, Cyber Essentials Plus, ISO 27001 or any audit.
- Not legal advice. Rules we show are ones that may apply to you; a lawyer or your regulator decides if they do.
- The points, weights and score bands are our own choices. No standard sets them, and an independent expert has not reviewed them yet.
The questions we ask
Counted from the live question bank.
Questions and checks with a checked source, by framework (out of 145)
One question can point to several frameworks. Items whose source is still being confirmed are not counted.
How strong the evidence is
Across all 840 items in the register: questions, checks, rules, map parts, steps and fixes.
233 items show "Source being confirmed" in the app until we have checked their source again.
How the numbers are worked out
The rules in use today, with the basis we have for each.
Points per answer
Each answer scores 0 to 3 points: 0 not in place, 1 partly, 2 meets Cyber Essentials (or the CIS basic safeguards), 3 goes beyond. An answer that meets a Cyber Essentials must-have always scores at least 2; one that does not, at most 1.
Rung 2 is the Cyber Essentials v3.3 requirement or the CIS Controls v8.1 IG1 safeguard; rung 3 is IG2 or CAF good practice. Must-have questions are re-anchored in code so the points follow the certification rung, not the maturity ladder (method AB, 30 Oct 2026).
Derived — a fair reading of a standardCyber Essentials All five control themes (requirement wording per question) · CIS Controls IG1 / IG2 implementation groups · NCSC guidance NCSC Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026) · NCSC guidance IASME/NCSC Danzell question set, live 27 Apr 2026"I don't know"
"I don't know" scores 0, counts as not in place on your map and in the checks below, and is marked unknown. Answers you have not proved still count; they are marked as told to us.
One rule everywhere: score 0 in the total, High exposure on the map, a gap for a Cyber Essentials must-have and an open defence on an attack route. Mirrors Cyber Essentials, where an unanswered control fails.
Derived — a fair reading of a standardNCSC guidance NCSC Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026)Score for each topic
Each topic's score is the points you got as a percentage of the points possible.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedOverall score
Your overall score is the average of your topic scores. Every topic counts the same.
Equal weights are the simplest rule to defend; risk ordering lives in the gates and the plan, not in weights. Panel finding CA-13: prevalence weights would cut backups and incident response.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewReference ISO/IEC 27005:2022 (risk criteria defined and documented, clause 6)Older score words
Some older screens use At risk (0 to 39), Developing (40 to 59), Established (60 to 79) and Resilient (80 to 100).
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedScore words and colours
Below 30 is Critical, 30 to 49 High, 50 to 69 Medium, 70 and above Low.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedCyber Essentials readiness
Each Cyber Essentials must-have is met, not met or unknown. Readiness is the share of must-haves you meet, held at 49 by one gap and 29 by two or more. Must-haves we do not ask are listed, never counted as met.
Cyber Essentials passes only when every requirement is met; the readiness page now counts must-haves, not maturity extras such as EDR or passkeys. Must-haves we do not ask are listed as not asked, never as met.
Direct — a standard says thisCyber Essentials All requirements must be met (v3.3 introduction) · NCSC guidance NCSC Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026) · NCSC guidance IASME/NCSC Danzell question set, live 27 Apr 2026How exposed a part is
A part is High exposure when your answers score under a third of the points, Medium under two thirds, otherwise Low. "I don't know" shows as High, marked unknown. A failed outside check shows as High.
Same 'I don't know' rule as the score (method AB). Ratio cut points stay a judgement.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedHow much harm a part could do
Each part has a set impact if it goes wrong: Critical (4), Major (3), Moderate (2) or Minor (1).
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedPart score
A part's score is its exposure (High 3, Medium 2, not answered 1, Low 0) times its impact (4 down to 1).
Derived — a fair reading of a standardSource being confirmedFix first, plan it in, keep an eye
A part scoring 9 or more is Fix first, 4 or more is Plan it in, otherwise Keep an eye.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedRisk for each area
An area takes the level of its worst part: 9 or more Critical, 7 or more High, 4 or more Medium, otherwise Low.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedGovernance level
Your governance level is your average answer on a 0 to 4 scale, capped at Level 2 until an expert checks it. "I don't know" counts as not in place.
Declared answers never exceed Level 2 until an assessor validates them; 'I don't know' counts as not in place (method AB).
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewPoints for each fix
Each fix shows the score change when it is proven: how far your score would rise if the questions it covers were at the best answer. A fix for a missing Cyber Essentials must-have is never shown as worth nothing.
Points are shown as score change, never as risk reduced. Plan order uses risk reduced (see METHOD-PLAN).
Derived — a fair reading of a standardReference NIST SP 800-30 Rev.1 · Reference ISO/IEC 27005:2022 · Reference CIS RAM v2.1Score after proof
When we accept proof of a fix, the questions it covers count at the best answer.
Derived — a fair reading of a standardEffort and plan pace
Fixes are sized small (1), medium (2) or large (3). The plan fits about 8 of these in each quarter (between 6 and 14).
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedDefence Cyber Certification deadline
Plans use 31 December 2026 as the deadline for Defence Cyber Certification Level 0.
Derived — a fair reading of a standardAttack route likelihood
Each attack route starts with a likelihood from 3 to 5, based on how common that kind of attack is.
Derived — a fair reading of a standardSource being confirmedAttack route weakness
A route gets less likely as the parts it passes through get stronger. A critical part counts in full, a low-risk part one fifth.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedAttack route urgency
A route is more urgent when the business steps it stops can be down for fewer days. Routes that take money count as one day.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedBusiness map risk words
On the business map, a High exposure part with Critical impact shows as Critical. Other parts show their exposure word.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedCyber Essentials must-haves
Cyber Essentials must-haves: one missing or unknown holds your score at 49 at most (High), two or more at 29 (Critical). Questions we did not ask never hold it down.
Cyber Essentials passes only when every requirement is met, and the Danzell question set makes MFA on every cloud service and the 14-day rule automatic fails. A firm that fails one cannot be called low risk; two fails mean basic protection is missing, the same as an NCSC CAF outcome marked not achieved.
Derived — a fair reading of a standardCyber Essentials All requirements must be met (v3.3); Danzell automatic fails: MFA, 14 days · NCSC guidance NCSC Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026) · NCSC guidance IASME/NCSC Danzell question set, live 27 Apr 2026 · NCSC Cyber Assessment Framework achieved / not achieved outcomesOpen attack routes
Attack routes: a route stays open while any of its defences is missing or unknown. An open route that would stop part of your business within 2 days, or take money, holds your score at 49 at most (High).
Backups, payment checks and alert watching are not Cyber Essentials controls, so a Cyber Essentials gate alone left firms with deletable backups or no payment checks at Low (panel CA-05). Two-step sign-in counts only when it covers everyone and is an app or phishing-resistant method (panel CA-02).
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewReference NIST SP 800-30 Rev.1 Guide for Conducting Risk Assessments (Appendix F Table F-2, Appendix G Table G-2) · Legislation ISO 22301:2019 clause 8.2.2 business impact analysis · Reference CISA advisory AA23-320A Scattered Spider · NCSC guidance NCSC Offline backups in an online world · Reference Kroll Akira ransomware deep diveThe score you see
The score you see is the lowest of your score and any hold above, and its word follows from it. We always say why it is held. The score before any hold is under Expert detail.
One number and one word on every screen, report, verification page and email, with the reason beside it, so nobody reads a capped score as an average.
Derived — a fair reading of a standardReference ISO/IEC 27005:2022 (risk criteria defined and documented, clause 6)Order of your plan
Your plan puts legal must-dos and flaws attackers are using now first, then fixes that lift a hold, then the rest by how much risk they remove. The score change when proven breaks ties.
Risk reduced, not score points, decides the order (panel CA-03): two-step sign-in, remote access and backups rise above paperwork.
Derived — a fair reading of a standardReference NIST SP 800-30 Rev.1 Guide for Conducting Risk Assessments (Appendix F Table F-2, Appendix G Table G-2) · Reference ISO/IEC 27005:2022 (risk criteria defined and documented, clause 6)How likely an attack route is
How likely a route is: how many UK businesses report that way in (Cyber Security Breaches Survey 2025/26), times how weak your defences on it are, on the NIST risk assessment scale.
Phishing 38% and impersonation 12% of UK businesses (CSBS 2025/26). The headline release gives no figure for hacked remote access or supplier logins, so those routes use 12% until the survey tables are checked.
Derived — a fair reading of a standardCyber Security Breaches Survey DSIT Cyber Security Breaches Survey 2025/26 (published 30 Apr 2026) · Reference NIST SP 800-30 Rev.1 Guide for Conducting Risk Assessments (Appendix F Table F-2, Appendix G Table G-2)How much harm an attack route does
How much harm a route does: the fewer days your business could cope without the steps it stops, the higher. Routes that take money count as the same day.
Downtime comes from the firm's own business steps, which follow a business impact analysis (maximum tolerable period of disruption).
Derived — a fair reading of a standardLegislation ISO 22301:2019 clause 8.2.2 business impact analysisWhen the method changes
Old reports never change. Live screens use the current method and tell you once when it changed (method updated 30 Oct 2026).
Old reports stay exactly as issued; the live score always uses the current method.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedArea trend over time
Area trend: for each past assessment, the area is rebuilt from that assessment's answers. Each answered part counts Low as 1, Medium as one third and High as 0, weighted by its impact (Critical 4, Major 3, and so on). The point is the weighted share, out of 100. Scan and Microsoft 365 findings are left out, because their past state is not stored for each assessment.
Same rule as the overall trend: past answers are rescored with today's rules so the line and today's view agree. Impact weights are the risk map's own.
Derived — a fair reading of a standardLegislation NIST SP 800-30 Rev.1 (impact-weighted risk)
10 rules built for the next scoring engine (not in use yet)
Engine
points per answer: Built for the next version of our scoring. Not in use yet.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedEngine
row weights: Built for the next version of our scoring. Not in use yet.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedEngine
score caps: Built for the next version of our scoring. Not in use yet.
Derived — a fair reading of a standardEngine
answers without evidence: Built for the next version of our scoring. Not in use yet.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedEngine
scan beats answer: Built for the next version of our scoring. Not in use yet.
Derived — a fair reading of a standardEngine
attack paths: Built for the next version of our scoring. Not in use yet.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewSource being confirmedEngine
scan findings: Built for the next version of our scoring. Not in use yet.
Derived — a fair reading of a standardSource being confirmedWatch
how urgent an alert is: Watch priority: each alert gets a CISA SSVC decision (Act, Attend, Track*, Track) from the 36-leaf tree using Exploitation, Automatable, Technical Impact and Mission & Well-being (Table 8 combines Mission Prevalence and Public Well-being).
The tables are copied unchanged from CISA SSVC Guide (Nov 2022) Tables 8 and 9 and tested against the guide; CyberPostura only chooses the inputs.
Direct — a standard says thisNIST Cybersecurity Framework ID.RA-05, ID.RA-06 · Reference CISA Stakeholder-Specific Vulnerability Categorization Guide (November 2022)Watch
what we feed the CISA tree: Watch inputs: per check, exploitation, automatable and technical impact are set per website, email and Microsoft 365 check. CISA's list of exploited flaws = active by definition; NCSC items say active only when they use exploitation wording. Mission prevalence: essential if a business step that depends on the part can be down 2 days or less, support if any step uses it or the firm has no steps, else minimal. Public well-being: material for data, business processes, staff breaches and leak-site claims, else minimal.
CISA defines the decision points but not how a small-business tool should fill them for misconfigurations (email, Microsoft 365). Our values: email spoofing and missing MFA are treated as actively exploited because those attacks are in common use; the 2-day line is the same as METHOD-GATE-ROUTES.
Judgement — our own choiceCyberPostura judgement — awaiting expert reviewCISA Known Exploited Vulnerabilities CISA KEV catalogue · NCSC guidance NCSC feeds (OGL v3.0) · Reference NIST SP 800-30 Rev.1Watch
alerts on your plan: A fix linked to an open Watch alert rated Act or Attend goes to Priority 1, after legal must-dos and actively exploited flaws. Track and Track* alerts do not change the plan order. Points still move only when proof is accepted.
CISA says Attend and Act are remediated sooner than standard update timelines; Priority 1 is our "do first" group.
Derived — a fair reading of a standardReference CISA Stakeholder-Specific Vulnerability Categorization Guide (November 2022)
Other people’s frameworks we refer to
CIS Critical Security Controls® v8.1 are owned by the Center for Internet Security. We give safeguard numbers only and describe each in our own words; we do not reproduce the Controls.
MITRE ATT&CK®: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Think something here is wrong?
Email info@cyberpostura.com. We record every challenge against the register and update this page when a rule or source changes.