How is the degree of fulfillment calculated in the ISMS Cockpit – and why do exceptions not count?

The degree of fulfillment is the central key figure of the ISMS Cockpit. This article explains how the value is composed and which factors feed into the calculation.

What does the degree of fulfillment measure?

The degree of fulfillment indicates the share of fulfilled requirements – in relation to the applicable requirements, not to the total number of all requirements of the standard. It therefore shows how far the requirements relevant for your organization have been implemented.

Why do "not applicable" requirements not reduce the degree of fulfillment?

Requirements that you have classified as "not applicable" are excluded from the reference value. They count neither as fulfilled nor as open. As a result, requirements that do not apply do not distort your implementation status downwards.

Why do accepted exceptions not count?

If a residual risk is deliberately accepted as an exception, this takes the requirement out of the degree of fulfillment: it counts as "accepted" – neither as fulfilled nor as open. This way the degree of fulfillment only reflects the requirements on which implementation work is actually still pending.

What is the difference between status and implementation level of the measures?

The "Status" describes the assessment state of an individual requirement (for example Not fulfilled, Partially fulfilled, Fulfilled). The "Implementation level of measures" is a separate key figure in the breakdown of the cockpit and shows how far the measures linked to the requirements have been implemented. This is how you distinguish between the assessment state of a requirement and the progress of the concrete measures.

Does the degree of fulfillment update immediately?

Yes. As soon as you change the assessment state of a requirement, this feeds directly into the degree of fulfillment of the cockpit. The operation is also logged in the activity history of the requirement.