Enforcement Posture is how much of the work toward ideal is done, within what Qpoint can know and govern. Each policy-to-control mapping counts once, and it's at ideal when its policy has reached the strongest mode it can: Enforce, or Observe if the policy can only observe. A policy on three controls counts three times, and three policies on one control count three times. It reads each policy's published mode, for the whole organization. So 100% means Qpoint's part is done. It doesn't mean the framework is met, or that every endpoint has the change.

Exceptions are counted on their own, once each however many controls their policy maps to: active, not expired, revoked or waiting in the draft. They read by which way they move a policy's mode, and they never change Enforcement Posture.

Left out:2 mapped controls are mostly beyond what Qpoint can govern, so they stay listed and aren't counted. Every control in this mapping has a Qpoint policy.

Compliance Score is how the activity holds to that, over the last 30 days: findings raised by those policies, against what they checked. Findings older than that still count while they are open. A policy that is off raises nothing, so its Score says nothing.