Toolkit reporting
How your risk assessment is graded
Two things decide your grade: your score across every control, and a short list of controls important enough to limit the grade on their own.
Three tiers of controls
Not every control counts the same. The controls insurers care about most carry the most weight.
ABCDF
Critical controls
The protections insurers look at first. Missing even one limits your grade.
Foundational controls
The basics that keep a small incident small. Gaps here also limit your grade.
Comprehensive controls
Everything else that shows a mature program. These raise your score.
What this means for you
Some controls can limit the grade, however high the score. Fixing one of those dramatically reduces risk.