Understanding the weighted compliance score (L1/L2)
A compliance score is only useful if you know what it measures. A raw "X of Y checks passed" ratio treats a critical control and a cosmetic setting as equal. Both GUARD tools weight every result by criticality — and the balance between the levels says something about each perimeter.
The problem with a simple ratio
Imagine two organisations that both pass 212 of 300 evaluated controls — the same 71%. In the first, the failures are minor level 2 hardening items. In the second, they include unblocked legacy authentication, a service account sitting in Domain Admins and a storage account open to the Internet. A flat ratio calls both 71%. That is misleading, and it makes the score hard to defend.
Weighting by criticality
Both GUARD tools classify each control by level and weight it accordingly:
- Level 1 (fundamental) — controls that address core, high-impact risk. Weighted 3×.
- Level 2 (hardening) — defence-in-depth measures, to be arbitrated against context and cost. Weighted 1×.
A warning — an indeterminate result, an architecture choice, something the audit could not fully confirm — counts for half the weight rather than as a straight pass or fail. Controls in error or not evaluated are excluded from the calculation entirely: neither in the numerator nor in the denominator. You do not conclude on what you could not read.
Why 3×? The multiplier encodes a simple truth: a single failed fundamental control usually exposes you more than several failed hardening controls. The score should drop accordingly.
The same arithmetic, two different balances
The formula is identical across the two tools, but the split between levels is not, and that tells you something about each perimeter.
| Referential | Level 1 | Level 2 | What it means |
|---|---|---|---|
| Entra ID & M365 | 165 | 153 | Roughly balanced: most identity hardening is free to apply |
| Active Directory | 96 | 80 | Level 1 dominates: on a directory, the fundamentals are the risk |
Overall and per-category scores
Each tool reports a global score and a breakdown — per source on Entra ID & M365, per category on Active Directory. This matters because an overall 70% can hide a category sitting at 20%. The breakdown is sorted weakest first, so the first line is where the effort belongs.
What the score does not say
A weighted score is comparable to itself over time, not to another estate. A small perimeter mechanically scores better, because many controls come back compliant “not applicable” — a domain with no AD CS passes every certificate template control. That is not a flaw in the method: an absent risk is an absent risk. But it is why you compare an estate with itself, and why the ANSSI maturity level and the attack path picture should be presented before the percentage.
A defensible number
Because the weighting is explicit and documented, the score is one you can put in front of an executive committee, a cyber insurer or an ISO assessor and explain. It is not “percentage of boxes ticked” — it is a risk-weighted measure of posture, with a methodology behind it.
Watching it improve
The same weighting makes progress meaningful. When you remediate fundamental issues first, the score climbs faster than if you had cleared minor items — exactly the behaviour you want to encourage. Comparing two audits over time turns remediation work into a measurable trend, provided you re-run the same baseline on the same perimeter.