About compliance score calculation for SCAP assets

CCS defines the following attributes to calculate the compliance scores of the rules:

• Count

  This attribute is set to either 1 or 0 based on the evaluation result values. The value 1 is set for the result value, Pass, Fail, Error, and Unknown. The value 0 is set for the result values, NotApplicable, NotChecked, NotSelected, Informational, and Fixed.

  The evaluation result values of the SCAP benchmark rules and their contribution to the compliance score calculation are as follows:

  • Pass

    This means that the asset has satisfied all the conditions of the rule. A pass result contributes to the weighted score and maximum possible compliance score.

  • Fail

    This means that the asset did not satisfy all the conditions of the rule. A fail result contributes to the maximum possible compliance score.

  • Error

    This means that the CCS has encountered a system error and is not able to complete the evaluation. Hence, the status of the asset's compliance with the rule is uncertain. For example, if CCS runs with insufficient privileges on the asset, then an error can occur.

  • Unknown

    This means that CCS has encountered some problem and the result is unknown. For example, if CCS was unable to interpret the output of the evaluation.

  • Not Applicable

    This means that the rule is not applicable for the asset that is evaluated. For example, if a rule is specific to an operating system version to which the asset does not belong, then the evaluation result is not applicable. Such kind of evaluation result values do not contribute to the compliance score.

  • Not Checked

    This means that the rule is not evaluated by CCS. Such a result value is designed for the rules that have a role as, unchecked and for the rules that have no properties. Such type of evaluation result values do not contribute to the benchmark compliance score.

  • Not Selected

    This means that the rule is not selected in the benchmark. Such type of evaluation result values do not contribute to the benchmark compliance score.

  • Informational

    This means that the rule's result value is simple information that an auditor or administrator uses. Such result is the default value for rules that have a role as, unscored. This result value is designed for rules that can extract information from the asset. This kind of evaluation result values do not contribute to the benchmark compliance score.

  • Fixed

    This means that the rule has failed, but is fixed. Such kind of evaluation result values must contribute to the compliance score similar to the result value, pass.

• Score

  This attribute is set to 100 or 0 based on the evaluation result values. For all the result values whose count is 1, the score is set. No score is set for the result values whose count is 0.

• Accumulator

  This attribute value is the sum total of weights of the rules.

The formula that CCS uses to calculate the compliance score for a rule and group against which an asset is evaluated is as follows

• Rule

  compliance score of a rule = (score of a rule) * (weight of the rule)

• Group

  The normalized score of a group = (Sum of the scores of the rules or groups under the group) / (sum of the weights of the rule or groups under the group)

  Compliance score of a group = (Normalized score)* (Weight of the group)

The formula that CCS uses to calculate the weighted compliance score of a profile is as follows:

• Weighted compliance score of a profile for a single asset

  Weighted compliance score of a profile = (compliance score of the rules) / (sum of weights of the rules)

• Weighted compliance score of a profile for multiple assets

  Weighted compliance score of the profile = (sum total of the compliance scores of the profiles evaluated against every asset) / (total number of assets)

• Weighted compliance score of a profile using weights of the group in which the rule exists

  Weighted compliance score of the profile = (Sum of the scores of the rules or groups under the profile) / (sum of the weights of the rule or groups under the profile)