One number for your
security maturity
TractionScore weighs six dimensions of ISMS health into a single 0-to-100 score, backed by live cloud signals and control evidence. One number for the leadership deck, the sales questionnaire, and the surveillance audit prep. Shared under your control, no 200-page evidence pack attached.
TractionScore
Advanced posture
Illustrative example
Why a single number matters
Ask three people inside the same company how mature their security program is and you will get three answers. TractionScore gives everyone one number to anchor the conversation, with the evidence to back it up.
Moves the sales conversation forward
Prospects stop asking "show me your security" and start asking about the specific dimensions where your score is lower. The conversation shifts from gatekeeping to improvement planning. Procurement teams get something they can compare.
Makes internal progress visible
Month-over-month movement per dimension shows leadership whether the program is actually improving or just holding steady. A score that goes from 62 to 78 in two quarters is a real answer to "what are we getting for the security budget?"
Survives audit season
The same evidence that moves your score is the evidence auditors sample from at Stage 2 and surveillance reviews. Docs, controls, audit records, risk entries, cloud signals. No parallel record-keeping.
Who asks for your score
Security due diligence is now a standard part of B2B buying. TractionScore gives you one answer you can share with four different audiences, without exposing the control detail underneath.
Enterprise customers
Procurement teams run security review on every new vendor. A TractionScore profile replaces the first 30 minutes of that review with a number and drops the 200-page evidence pack.
Supplier assurance reviewers
SSPA, SIG, CAIQ, and HITRUST questionnaires often start with a posture overview question. TractionScore fills that first answer concretely, before the line-by-line responses go in.
Auditors and assessors
Auditors want clause-level evidence, not a score. But TractionScore lets them orient quickly: strong on controls, weaker on management review, score rising quarter-over-quarter. Context before sampling. Same for CMMC C3PAO assessors looking at your readiness before fieldwork.
Leadership, investors, insurers
Boards and cyber insurers want a number. Leadership wants to know the security budget is producing something. TractionScore is what goes in the quarterly pack, with trend and dimension breakdown.
What does the score mean?
Five maturity bands, calibrated against real ISMS maturity models. The band means something in front of an auditor, not just in a slide deck.
Score ranges: Foundational (0 to 25), Developing (26 to 50), Established (51 to 75), Advanced (76 to 90), and Optimized (91 to 100). Bar widths reflect the number range covered by each band.
Foundational
Scope undefined, risk register missing or stale, policies ad-hoc or absent. You know the program needs to exist and you are starting.
Developing
Core policies written, a few controls implemented, risk register populated but not reviewed on cadence. First Stage 1 audit would surface nonconformities.
Established
Controls implemented across scope, risk work on cadence, management review happens. Realistic zone for first ISO 27001 certification, SOC 2 Type II attestation, or a CMMC L2 C3PAO assessment.
Advanced
Controls verified by live cloud signals, evidence indexed by clause, surveillance audits faster every year. Score customers reference in sales conversations.
Optimized
Multi-framework program operating in steady state. Continuous control monitoring, management review as a quarterly habit, a score that moves only when something real changes.
Six dimensions. One score.
Weighted by impact on real audit outcomes, not equal-weight averages. Risk and Controls carry the most weight because they are what your auditor samples first. Connected Intelligence carries the least because cloud signals verify controls you already have, they do not replace them.
Documentation
15%Weight in total score
ISMS scope statement, interested parties register, policies and procedures on cadence, SoA complete and current. The Clause 4 and Annex A.5.1 work auditors trace everything back to.
Risk Management
25%Weight in total score
Asset register with owners and classification, risks scored with likelihood and impact, treatment plans tied to controls, review cadence kept. One of the top two sources of nonconformities at Stage 2.
Control Implementation
25%Weight in total score
Annex A controls implemented with evidence attached, SOC 2 TSC mapped, status current. The dimension that moves the most when you close real gaps.
Operational Performance
15%Weight in total score
KPIs defined and monitored, incidents logged and triaged, training completed on schedule. The dimension that separates a program that works from a program that exists on paper.
Audit and Review
10%Weight in total score
Internal audit program run to schedule, findings tracked to closure, management review held on cadence with a documented decision record. ISO 27001 Clause 9 work and CMMC CA-family practices, often the other top source of nonconformities.
Connected Intelligence
10%Weight in total score
Cloud signals from Azure, AWS, and Google verifying controls automatically. A policy approved this morning shows up in the score this afternoon. Labeled Cloud in the hero gauge for short-form.
Share the score, not the control library
When a prospect, customer, or partner asks for your security posture, they do not need 200 pages of evidence. They need one number with context. The Registry lets you share your TractionScore profile under access controls you set per relationship, with an audit trail of who looked at what.
- Approve or decline each access request individually
- Trusted-domain rules for partners who request access often
- Time-boxed access that expires automatically
- Audit log of who viewed the profile and when
- Share the score and band, keep the control-level detail private
Acme Corp
SaaS
Pick a starting point
Start a free Starter trial and your TractionScore is calculated from day one. The score is honest about where you are, and it moves as you close real gaps.