Scores based on variety of factors including vulnerabilities discovered, attack impact, attack likelihood and mitigating controls Includes guidance with instructions and evidence to aid in remediation efforts