Weighting Scorecard scores

To address the prioritization of initiatives and produce a more representative score, Panaseer supports weighting of dashboard scores when calculating the overall score.

Why use weighting in Controls Scorecard scores calculations?

The overall score on the scorecard gives you an automated assessment of performance based on a selection of scored dashboards. Each dashboard represents a particular initiative in your cybersecurity strategy, scored according to metric performance.

When calculating the overall score, the default approach is to do a mean average of the dashboards scores. However, this assumes equal importance for all the initiatives that the dashboards represent.

In reality, not all initiatives carry the same weight of importance. Initiatives are prioritized according to the type of risks, your organization's objectives, and your compliance requirements. 

Simple visualization showing how dashboards can vary in importance.

Weighting provides a mathematical method of setting initiative importance. The overall score can then more accurately reflect your status according to your priorities.

How weightings are used in the calculation

Panaseer uses percentages to set weights, using the following methods:

• Weighted by percent: Each dashboard score is assigned a percentage weight.
• Proportional weighting: The percentage weight represents its relative importance in a calculation. For example, 50% weight is twice as impactful as 25% weight.
• Weights add up to 100%: All the percentages must add up to exactly 100%, ensuring the dashboards collectively make up the total influence.

We derive the overall score by multiplying each dashboard score by the proportional representation of its percentage weight and summing each result:

• Overall score = (dashboard score 1 x (percentage weight 1/100)) + (dashboard score 2 x (percentage weight 2/100)) + ....

For example, if you have three dashboards with 70%, 10%, and 20% weights, the formula is:

• Overall score = (dashboard score 1 x .7) + (dashboard score 2 x .1) + (dashboard score 3 x .2)

Weighting example

Say you have three dashboards, and one is considered twice as important as each of the others. This means the most important dashboard has twice the weight of the other two, which are equally weighted.

We can write this as follows:

• Patch Controls: 1 times the baseline level of importance.
• User Awareness: 1 times the baseline level of importance.
• NIST Cybersecurity Framework: 2 times the importance of the others.

The ratio of importance for these dashboards is 1:1:2.

To derive the percentage for the baseline level dashboards:

• Divide 100 by the sum of the ratio terms to find the baseline percentage:
  100/(1+1+2) = 25%

You can then calculate the percentages by multiplying the baseline percentage by the level of importance:

• Patch Controls: 1 x 25% = 25%
• User Awareness: 1 x 25% = 25%
• NIST Cybersecurity Framework: weighting = 2 x 25% = 50%

Let's say the score for these three dashboards is 68%, 72%, and 48%, respectively. The Controls Scorecard score then equals:

• (68 x .5) + (72 x .25) + (48 x .25) = 34 + 18 + 12 = 64%

If you use fractional levels of importance, you can still use the same calculation. Say you have three levels of importance, with the ratio, 2:1:0.5. The baseline is 100/(2+1+0.5) = 28.57. Multiply this by each ratio term to find the percentage weight for the associated dashboard score.

You need to round percentages to ensure they add up to 100%.

Refer to Building Controls Scorecards for more information. Weighting is also available in calculating the Dashboard score. For more information, refer to Weighting in the Dashboard score.