Secure Score Controls - Scores assigned to each control

%3CLINGO-SUB%20id%3D%22lingo-sub-850441%22%20slang%3D%22en-US%22%3ESecure%20Score%20Controls%20-%20Scores%20assigned%20to%20each%20control%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-850441%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20there%2C%3C%2FP%3E%3CP%3EWith%20the%20new%20secure%20scoring%20model%20using%20the%20controls%20group%2C%20I%20can%20see%20that%20MS%20has%20assigned%20max%20secure%20score%20for%20each%20control.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%2C%20is%20there%20any%20specific%20reasoning%20for%20MS%20to%20assign%20those%20specific%20max%20scoring%20for%20each%20control%3F%3C%2FP%3E%3CP%3EFor%20example%2C%20the%20control%20of%20Enable%20MFA%20is%20assigned%20max%20score%20of%2050%2C%20while%20the%20control%20of%20Enable%20Auditing%20and%20logging%20is%20assigned%20max%20score%20of%205.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20thought%20that%20auditing%20and%20logging%20is%20also%20very%20important%20but%2C%20it%20has%20max%20score%20of%205%20only.%20so%2C%20I%20am%20wondering%20what%20is%20the%20rationale%20of%20assigning%20different%20max%20scores.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-857933%22%20slang%3D%22en-US%22%3ERe%3A%20Secure%20Score%20Controls%20-%20Scores%20assigned%20to%20each%20control%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-857933%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20would%20like%20to%20provide%20a%20prioritized%20score%20for%20the%20controls%20so%20customers%20can%20focus%20first%20on%20the%20most%20important%20security%20configurations.%3C%2FP%3E%0A%3CP%3EWhile%20auditing%20is%20important%20mainly%20to%20investigate%20an%20attack%3B%20enabling%20MFA%20is%20an%20improtant%20first%20to%20do%20protection%20layer%20to%20prevent%20a%20breach%20of%20account%20or%20resources%20%3B%20hence%20we%20prioritize%20it%20higher.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Visitor

Hello there,

With the new secure scoring model using the controls group, I can see that MS has assigned max secure score for each control.

 

So, is there any specific reasoning for MS to assign those specific max scoring for each control?

For example, the control of Enable MFA is assigned max score of 50, while the control of Enable Auditing and logging is assigned max score of 5. 

 

I thought that auditing and logging is also very important but, it has max score of 5 only. so, I am wondering what is the rationale of assigning different max scores.

1 Reply

We would like to provide a prioritized score for the controls so customers can focus first on the most important security configurations.

While auditing is important mainly to investigate an attack; enabling MFA is an improtant first to do protection layer to prevent a breach of account or resources ; hence we prioritize it higher.