Each security measure in your security base is qualified by three complementary scores: efficiency, operations, and performance. These three scores are now directly visible in your security base table, without needing to go through the Policies module.
The performance score is the result of two elements: the efficiency and the operations of the measure.
What is the efficiency of a security measure?
Think of the efficiency of a security measure as your confidence in how well it currently works.
If you believe it is working at maximum efficiency, you leave it at 100%.
If you identify areas for improvement, you can create one or several improvement actions.
For each action, you indicate by how much it could increase efficiency (for example 25%).
When an improvement action is created, current efficiency is automatically reduced by that percentage (100% - 25% = 75%).
💡 If several actions are in progress, their impacts add up (for example, two actions of 25% and 10% will bring efficiency down to 65%).
Every time an action is completed, efficiency recovers the points from that action, never exceeding 100%.
What is the operations score of a security measure?
The operations score evaluates whether the security measure keeps working properly over time, through recurring controls.
These controls can be of two types:
Recurring tasks: to reach a score of 100, all scheduled tasks must be completed. The score therefore depends on the number of tasks planned and how many were actually done.
Performance indicators: you are assessed on results achieved, for example the "Percentage of people who don't click on a phishing campaign". The closer the result is to 100%, the more it shows that your "Awareness program" security measure is performing well.
🔎 A security measure can be tracked by one or more recurring tasks and/or indicators.
💡 If no recurring task or indicator is associated with the measure, its operations score defaults to 75% (a value configurable in your settings). A "Default" label is shown next to the score in that case, to distinguish it from a calculated score.
How efficiency and operations combine into the performance score
In summary, efficiency depends on whether improvement actions are currently in progress, while operations reflect the results of your recurring controls.
The performance score of a security measure is obtained by multiplying these two dimensions: performance = efficiency × operations.
💡 All three scores (efficiency, operations, performance) can be viewed directly in your security base table, in that order. You can also find them in more detail in the side panel of each measure.
🔎 A measure whose status is not implemented or to be handled does not yet display any of these three scores.
Frequently Asked Questions
Is the operations score of a measure with no task or indicator penalized?
No. In the absence of any recurring control, the operations score is not set to 0: it takes a default value of 75%, flagged with a "Default" label. This value is configurable in your settings.
Where can I view the efficiency, operations, and performance scores of a measure?
All three scores are visible directly in your security base table, as well as in the side panel of each measure. It is no longer necessary to go through the Policies module to access them.
What happens if I delete an improvement action?
Deleting an improvement action resets the measure's efficiency to 100%.