Every percentage you see in Zothommog is derived from your actual data. There are no padded metrics and no hidden boosts. This page explains exactly how each score is calculated so you can trust — and explain — what you're seeing.
Alignment with CIS Controls v8.1
Zothommog is not affiliated with, endorsed by, or certified by the Center for Internet Security (CIS). CIS Controls® is a registered trademark of CIS. The framework data used in Zothommog is sourced from CIS's publicly available publications and is used for tracking and educational purposes. For official CIS assessment tools and certification programmes, visit cisecurity.org.
CIS Controls score
Example. You're tracking IG1 (56 safeguards). 10 are implemented, 4 are monitored, 2 are excluded, the rest are in progress or not started:
Global Variables score
overall score = total_completed ÷ total_variables × 100
Variables are grouped into four priority categories. Each shows its own completion percentage. Only Completed variables count — In Progress and Skipped do not.
Why is In Progress excluded? A variable only generates reliable report data once it's confirmed complete. Marking something in progress means the value may still change — counting it would give you a false sense of readiness.
Framework compliance scores (NIS2, DORA, ISO 27001)
overall score = average of all requirement scores
Each framework's requirements (NIS2 articles, DORA chapters, ISO 27001 controls) map to specific CIS safeguards. Not all mappings are equally direct — a safeguard may strongly address a requirement or only weakly support it. Both the status of each safeguard and the strength of the mapping affect the score. The same formula applies to all frameworks.
Example. NIS2 Art. 21(2)(a) maps to three safeguards:
Safeguard 1.2 — In Progress (0.5) × Strong (1.0) = 0.50
Safeguard 2.1 — Planned (0.1) × Moderate (0.7) = 0.07
article score = (1.00 + 0.50 + 0.07) ÷ (1.0 + 1.0 + 0.7) × 100 = 1.57 ÷ 2.7 × 100 = 58%
Why does Planned count as 10%? A safeguard that's on the roadmap gives a regulator something to point to — intent matters. But it's only 10% of full credit, so it can't meaningfully inflate your score.
Why can my framework score be higher than my CIS score? The CIS Controls percentage is strict — only fully Implemented or Monitored safeguards count. Framework scores use a graduated scale where In Progress work contributes at 50% weight. So if you have many safeguards in progress, your framework scores will reflect that partial effort while your CIS score stays low until you finish the work. Both numbers are correct — they just measure different things: CIS measures what's done, frameworks measure how far along you are.
Next Steps ranking
ig_weight = IG1 → 3 · IG2 → 2 · IG3 → 1
effort_bonus = max(0, 4 − step_count) — fewer steps = higher score
fill_bonus = (filled_steps ÷ total_steps) × 2 — closer to done = higher score
planned_bonus = +1 if already Planned
The "Next Steps" panel on the dashboard and CIS Controls page ranks your remaining safeguards by this score. It's not a compliance metric — it's a triage helper that surfaces the highest-return work first. IG1 safeguards always come first because CIS v8 defines them as the minimum baseline for every organisation regardless of size.
A note on what scores don't tell you. A high CIS score means you've implemented the controls — not that you've tested them. A high framework score means your controls map well to the requirements — not that an auditor will agree. Use these numbers to track your own progress over time, not to claim compliance.