How Standpoint scores you
A readiness score is only useful if you can trust how it's calculated. Here's exactly what Standpoint measures, how your answers turn into a score and a maturity level, how the cross-framework crosswalk works, and — just as importantly — what the score is not.
The whole model in short — your score is built bottom-up from your own answers, with no black box:
- You answer each applicable control with a status and a maturity level.
- Your readiness score is the share of applicable controls you've implemented, with partial credit for in-progress work.
- Maturity measures how robust and repeatable a control is, separately from whether it exists.
- Controls marked Not applicable are excluded so they don't distort your score.
- It's a self-assessment — a planning tool, not a certification or audit opinion.
What we measure
Each framework is broken into individual controls (936 of them across 15 frameworks). For every control that applies to you, you record a status, an optional maturity level, the evidence you have, an owner, and a last-reviewed date. The score is built bottom-up from those answers — there's no black box.
How status maps to the score
Each control's status contributes to your readiness percentage as follows:
| Status | Meaning | Score contribution |
|---|---|---|
| Implemented | The control is in place and operating. | Full credit |
| Partially implemented | Some of the control is in place; work remains. | Partial credit |
| Not implemented | The control is not yet in place. | No credit |
| Not applicable | The control doesn't apply to your scope. | Excluded from the denominator |
Your readiness score for a framework is the total credit earned divided by the number of applicable controls, expressed as a percentage. Your overall readiness is the same calculation across every framework in your scope. Because Not-applicable controls are removed from the denominator, narrowing your scope honestly doesn't inflate or deflate your score — it just reflects what actually applies to you.
Readiness vs. maturity — two different questions
Readiness answers "is the control there?" Maturity answers "how good is it?" A control can be implemented but still early in maturity (ad-hoc, undocumented). We keep these separate on purpose: a high readiness score with low maturity tells you where to deepen, not just where to start. Maturity is recorded on a simple ascending scale so you can see, at a glance, which controls are robust and repeatable versus which are held together by hand.
How the crosswalk affects your score
Many controls satisfy several frameworks at once. When you answer a control, Standpoint shows the equivalent controls it maps to and lets you propagate that answer across them. This doesn't "inflate" any score — each framework is still scored on its own applicable controls — it just saves you from answering the same question multiple times. The result is that progress on one framework visibly moves the others it overlaps with.
What the score is — and isn't
The readiness score is a planning and tracking tool: it shows where you stand, where your gaps are, and whether you're improving over time. It is not a certification, an attestation, or an audit opinion. Only an independent, accredited body can certify ISO standards, and only a licensed CPA firm can issue a SOC 2 report. Standpoint helps you get ready for those — and organizes the evidence an assessor will ask for — but it does not replace them. We label this clearly throughout the product for exactly this reason.
Where our content comes from
For public-domain frameworks (for example NIST AI RMF, the EU AI Act, HIPAA, and GDPR) we show the official requirement text with attribution. For copyrighted standards (the ISO standards, the AICPA Trust Services Criteria, and PCI DSS) we show our own plain-English summary and point you to the official source — we never reproduce licensed text. Either way, the underlying control structure follows the published framework.
Run the free check and watch the methodology in action: a readiness score, your maturity, and the gaps behind the number.
Standpoint is a self-assessment aid — not a certification, attestation, or legal advice.