Patch Compliance Calculator

Compliance = findings closed within SLA ÷ findings due in the period; severity-weighted compliance = (5 × critical% + 3 × high% + 1 × medium%) ÷ 9. Compliance counts against findings whose deadline fell in the period, not against everything open — otherwise a large backlog of not-yet-due work inflates the number. The weighted variant exists because unweighted compliance is dominated by mediums, and a programme can report 96% while missing a third of its critical deadlines.

This is the figure auditors ask for and the one that appears in regulatory attestations, so it is worth defining precisely before someone else defines it for you.

This calculator takes 7 inputs: Critical findings due, Critical closed within SLA, High findings due, High closed within SLA, Medium findings due, Medium closed within SLA, Compliance target. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Verified by a rescan or an authenticated check, not marked done in a ticket. Self-attested closure is the single largest source of overstated compliance, and it fails the first time an auditor samples your evidence.

Exclude them from the denominator only if they have a named owner, an expiry date and a compensating control on record; otherwise they are breaches with paperwork. Report the accepted count alongside compliance so the two cannot be confused.