How your score is interpreted
0โ3
Critical Risk
Limited visibility or control. Immediate remediation should precede further deployment.
4โ7
Moderate Risk
Some controls exist, but important gaps remain across ownership, security or auditability.
8โ10
Mature Governance
Strong foundations are in place. Prioritise continuous monitoring and assurance.

