Skip to content
ENExplore Calculators

Cloud Compliance Calculator

Turn CIS benchmark control results into a severity-weighted 0-100 compliance score and show how many critical controls close the gap to target.

About Cloud Compliance Calculator

Unweighted pass rates flatter you: 142 of 180 controls passing reads as 79%, but if nine of the failures are critical the weighted score is lower and more honest. Weighting by severity also makes remediation planning arithmetic rather than argument — with 28 critical controls in scope each one is worth 1.43 points, while a low control is worth 0.28. Auditors and boards both ask for one number, and a raw pass rate that treats 'MFA not enforced on the root account' the same as 'S3 access logging disabled on a scratch bucket' will get you a clean report and a breach.

Formulas

Cloud Compliance

Weighted score = critical pass rate × 0.40 + high × 0.30 + medium × 0.20 + low × 0.10, so each severity band contributes its weight in full only when every control in it passes.

criticalRate
Critical controls passing ÷ critical controls in scope × 100
complianceScore
0–100 severity-weighted score
rawPassRate
All passing controls ÷ all controls, unweighted

Gap closure

Points per critical control = 40 ÷ critical controls in scope; critical fixes needed = ceil(gap ÷ points per critical), capped at the number still failing.

pointsPerCritical
Score points earned by fixing one critical control
scoreGap
Target score minus current weighted score

Worked example

With the default values below, Cloud Compliance Calculator returns Weighted Compliance Score of 75.1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Critical controls in scopeaccepts 0–5,000 controls
28 controls
Critical controls passingaccepts 0–5,000 controls
19 controls
High controls in scopeaccepts 0–5,000 controls
52 controls
High controls passingaccepts 0–5,000 controls
40 controls
Medium controls in scopeaccepts 0–5,000 controls
64 controls
Medium controls passingaccepts 0–5,000 controls
52 controls
Low controls in scopeaccepts 0–5,000 controls
36 controls
Low controls passingaccepts 0–5,000 controls
31 controls
Target compliance scoreaccepts 0–100 / 100
90 / 100

Results

Weighted Compliance Score
75.1 / 100
Grade
B — Good
Unweighted Pass Rate
78.9%
Critical Control Pass Rate
67.9%
Failing Controls
38 controls
Gap to Target
14.9 points
Critical Fixes Needed
9 controls
Verdict
Critical controls are the whole story — each one is worth several medium fixes at this weighting

Step by step

  1. 1Values used
  2. 2Cloud Compliance
  3. 3Gap closure
  4. 4Weighted Compliance Score= 75.1 / 100
  5. 5Grade= B — Good
  6. 6Unweighted Pass Rate= 78.9
  7. 7Critical Control Pass Rate= 67.9
  8. 8Failing Controls= 38 controls
  9. 9Gap to Target= 14.9 points

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cloud Compliance calculated?

Weighted score = critical pass rate × 0.40 + high × 0.30 + medium × 0.20 + low × 0.10, so each severity band contributes its weight in full only when every control in it passes. Unweighted pass rates flatter you: 142 of 180 controls passing reads as 79%, but if nine of the failures are critical the weighted score is lower and more honest. Weighting by severity also makes remediation planning arithmetic rather than argument — with 28 critical controls in scope each one is worth 1.43 points, while a low control is worth 0.28.

Why does Cloud Compliance matter?

Auditors and boards both ask for one number, and a raw pass rate that treats 'MFA not enforced on the root account' the same as 'S3 access logging disabled on a scratch bucket' will get you a clean report and a breach.

What values do I need to enter?

This calculator takes 9 inputs: Critical controls in scope, Critical controls passing, High controls in scope, High controls passing, Medium controls in scope, Medium controls passing, Low controls in scope, Low controls passing, Target compliance score. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Where do the 40/30/20/10 weights come from?

They mirror how CSPM tools and the CIS benchmarks themselves prioritise: the profile-1 critical items are the ones that prevent account takeover, so they carry most of the score. Adjust them if your risk appetite differs, but keep critical at least double high or the score stops distinguishing severity.

Should controls that do not apply count as failures?

No — scope them out. A control for a service you do not use is not a finding, and leaving it in as a failure permanently caps your score and trains people to ignore the number. Document the exclusion so the auditor sees a decision rather than a gap.

Related Calculators

Cloud Compliance Calculator | Calcrivo