How the compliance score is calculated
The score is phase-weighted — implementation carries 45 of 100 points — with priority weighting inside each phase and a hard zero for prohibited systems.
Your compliance score is not a flat percentage of completed obligations. It is phase-weighted, because finishing classification paperwork is not the same as finishing the heavy implementation work.
Phase weights
Each phase contributes a fixed share of the 100-point score:
- Classify — 10
- Scope & literacy — 5
- Implement — 45
- Assess — 20
- Register — 10
- Monitor — 10
So a system that has completed classification and scoping but not started implementation scores around 15%, not 33% — the score reflects where the real work is.
Empty phases are excluded
If a phase has no applicable obligations for your system (common for deployers), it is dropped and its weight is redistributed proportionally across the remaining phases. Role-specific journeys can still reach 100%.
Priority weighting within a phase
Inside each phase, obligations are weighted by priority: high-priority items count 3, medium 2, low 1. Completing a high-priority obligation moves the phase — and the overall score — three times as much as a low-priority one.
What does not count
- Obligations marked not applicable are excluded entirely.
- Incomplete obligations contribute nothing, whether overdue or simply not started — overdue items are additionally flagged and counted.
Prohibited systems score zero
A system whose active classification is in the Prohibited risk tier is forced to an overall score of 0, regardless of completed obligations — a banned practice cannot be compliant. Any prohibited system also zeroes the portfolio-level score on the dashboard, and a warning banner explains why. The dashboard also breaks the score down by risk tier (for example High 54% / Limited 88%), so a pile of finished low-risk systems can't mask an unfinished high-risk one.