How the score is built, and how it slips.

The method is subtraction. A fully implemented environment starts at 110 — one point of credit for each requirement — and every requirement that is not implemented removes its own weight from that total. Weights are not uniform: requirements are worth 5, 3 or 1 points depending on how much risk their absence introduces. Because the weights differ, the score is not a percentage of controls met, and treating it as one produces a materially wrong picture.

The practical consequence is that remediation should be sequenced by weight, not by ease. Closing a handful of five-point requirements moves the number further than closing a long list of one-point items, and it moves it in the direction a contracting officer is actually looking.

The score can go below zero

Because the weighted deductions total more than 110, an environment with little implemented lands on a negative number. A negative score is not a scoring error and it is not unusual for a first honest assessment. It is a statement about how much of the requirement set is outstanding, and it is considerably better to know it than to submit a number nobody can defend.

What a POA&M is for

A score below 110 is expected to be accompanied by a Plan of Action and Milestones: what is not implemented, who owns it, and by when. The plan is what makes a score below 110 a defensible position rather than an admission. A dated plan with named owners reads very differently to a contracting officer than a bare number with nothing behind it.

Why scores drift

A score is a measurement of an environment at a moment. Environments change and almost nothing announces that a control has lapsed. An MFA exception added for a vendor integration, endpoints falling out of patch management, a log volume filling and quietly stopping — none of these generate a notification, and all of them change the number.

The result is a score that is accurate on the day it is submitted and wrong some months later, with nobody aware. That gap is what continuous monitoring is for, and it is the reason a score is better treated as a monitored metric than as an annual event.

• Score by weight, and remediate in that order rather than easiest-first.
• Keep the POA&M dated and owned. An undated plan is not a plan.
• Re-verify after any material environment change, not only on the assessment calendar.
• Keep the evidence current, so a re-check is a review rather than a reconstruction.