Skip to main content

Scoring List Definitions

Four lists feed asset value scoring: the three security dimensions, and the bands their score lands in. Each is its own screen with its own permissions.

The three dimension lists​

Confidentiality, integrity and availability share one shape:

  • Code — issued from that list's own number template when left empty.
  • Name — the level as a person reads it.
  • Value — the weight the score formula reads. This is the field that matters.
  • Description — what the level means in practice, ideally as an observable test.
  • Active — inactive levels are no longer offered when rating an asset.

Each list sorts by value descending — highest first, since that is the order somebody classifying an asset scans in. No two levels within one list may carry the same value; a 3 in confidentiality and a 3 in integrity are unrelated and do not collide.

The shipped defaults run 1 to 5 on each list. See Scoring for the level texts.

The asset value band list​

The band list defines the levels an assessment is finally reported as. Its rows carry different fields:

  • Code / Name — Low, Medium, High, Critical.
  • Band number — the number the band formula has to return to land here.
  • Colour — how the band is drawn in the register, on the record and on the value label.
  • Description — conventionally the score range this band covers.
  • Active — inactive bands are not offered.

The band number is the only join​

The band formula returns a number, and the band that applies is the one whose band number equals it. Not the code, not the name, not the row order.

  • No two bands may declare the same band number — a result matching two bands would have no answer.
  • Every number the active formula can return needs a band. If the formula returns 4 and no band declares 4, saving the assessment fails with a message rather than storing it without a level.
caution

Nothing warns you when a formula's range and the band list drift apart. Re-check the bands after every change to the score formula — the symptom is either a save that fails or a band nobody ever reaches, and neither announces itself.

Four lists, four sets of permissions​

Each screen is permissioned separately. Being allowed to edit integrity does not imply being allowed to edit the band definitions — a dimension level decides what one number means, while the bands decide what the whole register reports.

Excel import and export​

Each list has its own import template, named after the list and carrying only that list's columns. A row naming a different list is refused, and the rest of the file still loads. A blank code column is filled from that list's own number template, which is also what keeps the four counters and prefixes apart.

All four screens support bulk delete, which refuses the whole selection if any row is in use by an assessment.

Changing a live scale​

Adding a level is safe: existing records keep the level they named, and the new one is offered from then on.

Changing an existing level's value does not re-score anything. Stored scores stay as they are, so rewriting a scale leaves two populations of assessments scored on different rules. Where that matters, the mechanism is a revision per asset.

tip

Get the scales right before the first assessment is opened. They are cheap to change on day one and expensive on day two hundred, because by then every change means a revision per asset to make it apply.