Turn CIS benchmark control results into a severity-weighted 0-100 compliance score and show how many critical controls close the gap to target.
Unweighted pass rates flatter you: 142 of 180 controls passing reads as 79%, but if nine of the failures are critical the weighted score is lower and more honest. Weighting by severity also makes remediation planning arithmetic rather than argument — with 28 critical controls in scope each one is worth 1.43 points, while a low control is worth 0.28. Auditors and boards both ask for one number, and a raw pass rate that treats 'MFA not enforced on the root account' the same as 'S3 access logging disabled on a scratch bucket' will get you a clean report and a breach.
Cloud Compliance
Weighted score = critical pass rate × 0.40 + high × 0.30 + medium × 0.20 + low × 0.10, so each severity band contributes its weight in full only when every control in it passes.
Gap closure
Points per critical control = 40 ÷ critical controls in scope; critical fixes needed = ceil(gap ÷ points per critical), capped at the number still failing.
Weighted score = critical pass rate × 0.40 + high × 0.30 + medium × 0.20 + low × 0.10, so each severity band contributes its weight in full only when every control in it passes. Unweighted pass rates flatter you: 142 of 180 controls passing reads as 79%, but if nine of the failures are critical the weighted score is lower and more honest. Weighting by severity also makes remediation planning arithmetic rather than argument — with 28 critical controls in scope each one is worth 1.43 points, while a low control is worth 0.28.
Auditors and boards both ask for one number, and a raw pass rate that treats 'MFA not enforced on the root account' the same as 'S3 access logging disabled on a scratch bucket' will get you a clean report and a breach.
This calculator takes 9 inputs: Critical controls in scope, Critical controls passing, High controls in scope, High controls passing, Medium controls in scope, Medium controls passing, Low controls in scope, Low controls passing, Target compliance score. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
They mirror how CSPM tools and the CIS benchmarks themselves prioritise: the profile-1 critical items are the ones that prevent account takeover, so they carry most of the score. Adjust them if your risk appetite differs, but keep critical at least double high or the score stops distinguishing severity.
No — scope them out. A control for a service you do not use is not a finding, and leaving it in as a failure permanently caps your score and trains people to ignore the number. Document the exclusion so the auditor sees a decision rather than a gap.