Home / How we score

How we score Copilot EU readiness

The scanner is a structured self-assessment, not a certification. Here is exactly how answers become a score.

Last source check 24 August 2026. This is not legal advice.

We re-read Microsoft Learn and Message Center monthly. Verified stamps move only if the sentence is still true. No Graph access. Not a certification.

Scoring rules

1. 01

   Answers become points

   Yes scores 1, Partly scores 0.5, No and I’m not sure score 0. Unknown is treated as a gap on purpose: if you cannot confirm a control, the report will not pretend it is in place.

2. 02

   Some questions are reversed

   For Anthropic models and web grounding, Yes means the setting is currently on — which is usually higher residual risk. Those questions use negative polarity, so Yes lowers the score and No raises it. Don’t know still scores 0: an unverified extra-EU path is not a pass. Flex Routing is asked as a control (“have you disabled it”), so Yes is the good answer.

3. 03

   Seven weighted areas

   Each question belongs to one control area. The area score is the average of its questions, then weighted into the overall score. Residency and oversharing carry more weight because they change what Copilot can process and see.

4. 04

   Topic quizzes are equal-weight, not the 25-question catalogue

   The identity, Flex Routing, EU Data Boundary, oversharing, DPIA and Foundry questionnaires score only their own questions. Each answer is equal (identity is four questions at 25% each). They do not inherit residency or oversharing weights from the executive pack. A control scores 1 when it is in place, 0.5 when partial, and 0 when missing or not yet checked. On reversed questions (Anthropic, web grounding), Yes means the feature is on and scores 0. Flags name the gap; they do not add a second scoring layer.

5. 05

   Thresholds

   75–100 is labelled strong readiness, 45–74 moderate, and below 45 low. These are working bands for a steering conversation, not pass/fail marks from a regulator.

6. 06

   Flags are extra, not extra points

   Certain answers raise attention items (for example Flex Routing not confirmed as disabled, or no recent oversharing assessment). Flags do not add a second scoring layer; they highlight work that usually belongs in a DPIA or rollout plan.

7. 07

   NIST CSF 2.0 is an Organizational Profile, not a second score

   Each of the 25 answers evidences one or more CSF 2.0 categories (for example Flex Routing → GV.SC / PR.DS). Category scores become the Current Profile. The Target Profile is a Community Profile for EU Copilot (typically 80 on core Govern, Identify and data-security categories). The gap list is Target minus Current. An implementation tier (1 Partial – 4 Adaptive) is derived from the assessed average, Govern, and open flags. Recover and several Respond categories are out of scope on purpose.

8. 08

   ISO/IEC 27001:2022 Clause 6.1 is a risk assessment, not a score

   Six Copilot scenarios are scored automatically from the same 25 answers. Likelihood = 1 + round(4 × weighted control-gap) for that scenario’s questions (gap 0 = control in place, 1 = open). Impact = inherent floor + 1 per open impact driver, capped at 5. The three matrices (lookup, current, residual) are plots of those numbers — not analyst judgement. Residual re-runs the engine with treatment questions closed. No override.

9. 09

   ISO/IEC 27001:2022 Annex A is a Statement of Applicability extract, not a certificate

   Each answer evidences one or more Annex A safeguards (for example Flex Routing → A.5.21 / A.8.9). Control scores become implementation status: implemented (at or above target), partial, or not implemented. Physical (A.7), backup, cryptography and secure development are not applicable in this Copilot-scoped SoA. Paste the table into your ISMS; do not treat it as an audit finding.

Which risk frameworks this follows

1. 01

   ISO 31000:2018

   Process

   Identify the Copilot risks, analyse them from your answers, evaluate against an EU residency appetite, treat with the 90-day plan, then monitor through a named owner.

2. 02

   GDPR Arts. 5(2), 32, 35 and Chapter V

   Legal duty

   Accountability, security of processing, DPIA, and extra-EU transfers. The score is not evidence; the DPIA, RoPA and recorded setting decisions are.

3. 03

   NIST Cybersecurity Framework 2.0

   Operational profile

   NIST CSF 2.0 Organizational Profile for Copilot: Current vs Target at category level, an implementation tier (1–4), and a gap list. Govern, Identify and Protect are core. Detect and Respond are partial. Recover is out of scope.

4. 04

   ISO/IEC 27001:2022 Clause 6.1

   Risk assessment

   Automated 5x5 scoring: likelihood = 1 + round(4 x weighted question-gap), impact = inherent floor + open drivers. Six scenarios plotted current vs residual. Residual re-scored by the same engine after treatment questions close. Residual is not accepted in this scan.

5. 05

   ISO/IEC 27001:2022 Annex A

   Statement of Applicability

   Copilot-scoped Statement of Applicability: Annex A safeguards scored from the 25 answers, implementation status (implemented / partial / not implemented), and a gap list. Physical, backup, crypto and secure development are not in this SoA. This is not a certification audit.

6. 06

   NIS2 (where you are in scope)

   Governance overlay

   Management accountability, supply-chain risk (Microsoft as ICT provider) and incident handling. The scan does not decide whether you are an essential or important entity.

7. 07

   ISO/IEC 42001 and NIST AI RMF

   AI management

   Copilot is an AI system you deploy. Govern, map, measure and manage: named owner, documented use, residual risk and a review cadence when Microsoft changes models. This is not a substitute for the CSF profile.

What this score is not

• It is not a NIST CSF certification. The Organizational Profile is a Community Profile for Copilot, not a full-enterprise Current Profile.
• It is not an ISO/IEC 27001 certification. The Clause 6.1 assessment and the Statement of Applicability are Copilot-scoped and do not replace your ISMS.
• It is not legal advice and not a DPIA. It can feed a DPIA; it cannot replace one.
• Microsoft product names, defaults and admin paths change. Verify every setting in your tenant before you rely on the report.
• A strong score with unverified answers is still an unverified posture. Check the “how to check” hints before you brief a board.

Choose an assessment