Calculator inputs
Use current-cycle figures. The form stays in one main column, while input cards flow into three columns on large screens, two on medium screens, and one on mobile.
Example data table
| Total Identities | Reviewed | Privileged | Privileged With MFA | Shared | Orphaned | Roles | Documented | Exceptions | SoD | Terminated | Deprovisioned < 24h | Checks | Passed | Compensating % | Final Score |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 250 | 235 | 28 | 27 | 4 | 3 | 36 | 32 | 5 | 2 | 12 | 11 | 40 | 36 | 82 | 87.93% |
This example shows a solid baseline with room to tighten documentation, exception closure, and privileged protection.
Formula used
The calculator converts control evidence into normalized scores, applies weighted importance, and then adjusts the result using compensating-control effectiveness.
- Review Coverage = (Identities Reviewed ÷ Total Identities) × 100
- Privileged MFA Coverage = (Privileged With MFA ÷ Privileged Accounts) × 100
- Role Documentation = (Documented Roles ÷ Total Roles) × 100
- Rapid Deprovisioning = (Deprovisioned Within 24h ÷ Terminated Accounts) × 100
- Control Validation = (Passed Checks ÷ Control Checks) × 100
- Shared Account Control = 100 − ((Shared Accounts ÷ Total Identities) × 1000)
- Orphaned Account Control = 100 − ((Orphaned Accounts ÷ Total Identities) × 1200)
- Exception Management = 100 − ((Open Exceptions ÷ Total Identities) × 700)
- SoD Conflict Health = 100 − ((SoD Conflicts ÷ Total Identities) × 900)
- Final Score = Weighted Base × (0.85 + 0.15 × Compensating Effectiveness)
Weights used: Review Coverage 14%, Privileged MFA 14%, Shared Account Control 10%, Orphaned Account Control 12%, Role Documentation 10%, Exception Management 10%, SoD Conflict Health 10%, Rapid Deprovisioning 10%, Control Validation 10%.
How to use this calculator
- Enter the total identities in your access-control scope.
- Add completed review counts for the current review cycle.
- Record privileged accounts and how many have MFA enabled.
- Enter shared, orphaned, and unresolved SoD-related account issues.
- Provide role inventory and documented-role totals.
- Add open exceptions and termination deprovisioning performance.
- Enter tested control checks, passed checks, and compensating-control effectiveness.
- Click Calculate Compliance to show the results above the form.
- Use the CSV and PDF buttons to export the current report.
Frequently asked questions
1) What does this calculator measure?
It estimates access-control compliance maturity by combining review coverage, privileged security, orphaned-account hygiene, role documentation, exception handling, deprovisioning speed, and validated test outcomes.
2) Is a high score equal to full compliance?
No. The score is a management indicator, not a legal opinion. Real compliance still depends on policy scope, framework requirements, control evidence quality, and auditor judgment.
3) Why are shared accounts penalized?
Shared accounts weaken attribution and increase misuse risk. The model reduces the score when shared identities rise because accountability, monitoring, and approvals become harder to prove.
4) Why do compensating controls affect the final score?
Temporary exceptions can be less risky when strong monitoring, approvals, logging, and short expiry periods exist. The adjustment reflects how well those alternative safeguards actually offset exposure.
5) What target should I use for deprovisioning?
For sensitive environments, same-day removal is best. This calculator uses twenty-four hours as the main benchmark because delayed offboarding leaves residual access available after separation events.
6) Can I use this for internal audits?
Yes. It works well for self-assessments, quarterly control reviews, evidence preparation, and tracking remediation trends before formal internal or external audit testing begins.
7) What frameworks can this support?
It can support mapping discussions for ISO 27001, SOC 2, NIST-style identity practices, and other governance programs where access reviews, least privilege, and removal timing matter.
8) How often should I recalculate the score?
Monthly is practical for most teams. High-change environments may recalculate weekly, especially after major onboarding waves, restructuring, privileged-access changes, or audit remediation activity.