Score network compliance from controls implemented, findings outstanding, config drift and audit currency.
Control coverage carries the largest weight because it is what an auditor tests first, while configuration drift is scored separately since a control can be documented and still not be in force on 10% of devices. Critical findings cost more than major ones, and audit currency only starts costing points after twelve months. Compliance failures are usually drift failures — the design was compliant, the running config is not — and separating the two dimensions shows which one to fix.
Network Compliance Score
score = control coverage (45) + configuration conformance (25) + findings penalty (20) + audit currency (10).
score = control coverage (45) + configuration conformance (25) + findings penalty (20) + audit currency (10). Control coverage carries the largest weight because it is what an auditor tests first, while configuration drift is scored separately since a control can be documented and still not be in force on 10% of devices. Critical findings cost more than major ones, and audit currency only starts costing points after twelve months.
Compliance failures are usually drift failures — the design was compliant, the running config is not — and separating the two dimensions shows which one to fix.
This calculator takes 7 inputs: Controls in scope, Controls fully implemented, Critical findings open, Major findings open, Devices in scope, Devices deviating from the golden config, Months since the last audit. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.