Understanding the weighted compliance score (L1/L2)
A compliance score is only useful if you know what it measures. A raw “X controls out of Y” ratio treats a critical control and a cosmetic setting as equals. Both GUARD tools weight each result by criticality — and the balance between levels says something about each perimeter.
The problem with a simple ratio
Picture two organisations that both pass 212 controls out of 300 assessed — the same 71%. In the first, the gaps are level 2 hardening items. In the second, they include legacy authentication left unblocked, a service account in Domain Admins and a storage account open to the Internet. A flat ratio reports 71% in both cases. That is misleading, and hard to defend.
Weighting by criticality
Both GUARD tools classify every control by level and weight it accordingly:
- Level 1 (foundational) — the controls that address first-order risk. Weighted 3×.
- Level 2 (hardening) — defence-in-depth measures, to be weighed against context and cost. Weighted 1×.
A warning — an indeterminate result, an architectural choice, a situation the audit could not fully confirm — counts for half the weight rather than as a clean pass or fail. Controls in error or not assessed are left out of the calculation: neither in the numerator nor in the denominator. You do not draw conclusions from what you could not read.
Why 3×? The multiplier encodes a simple truth: a single failed foundational control usually exposes you more than several hardening controls. The score has to drop accordingly.
Same arithmetic, two different balances
The formula is identical in both tools, but the split between levels is not — and that says something about each perimeter.
| Referential | Level 1 | Level 2 | What it means |
|---|---|---|---|
| Entra ID & M365 | 165 | 153 | Balanced: most identity hardening costs nothing to apply |
| Active Directory | 96 | 80 | Level 1 dominates: in a directory, the fundamentals are the risk |
Overall score and breakdown
Each tool reports an overall score and a breakdown — by source for Entra ID & M365, by category for Active Directory. This matters, because a 70% overall can hide a category at 20%. The breakdown is sorted from weakest to strongest: the first line is where to put the effort.
What the score does not say
A weighted score is comparable with itself over time, not with another estate. A narrow perimeter mechanically scores better, because many controls come back compliant as “not applicable” — a domain without AD CS passes every certificate template control. That is not a flaw in the method: an absent risk is an absent risk. But it is why you compare an estate with itself, and why the ANSSI maturity level and the exposure picture should be presented before the percentage.
A defensible number
Because the weighting is explicit and documented, this is a score you can put in front of an executive committee, a cyber insurer or an ISO auditor, and explain. It is not a “percentage of ticked boxes” — it is a risk-weighted measure of posture, with a method behind it.
Watching it improve
The same weighting makes progress meaningful. When you fix the fundamentals first, the score climbs faster than if you had cleared minor items — exactly the behaviour to encourage. Comparing two audits over time turns remediation work into a measurable trend, provided you replay the same baseline on the same perimeter.