Ideal state (baselines)
Decide which controls count for each customer, and with what thresholds, so scores, plans, compliance and reports measure what you agreed.
Updated
On this page
Each customer is measured against its own ideal state, also called its baseline: which security controls are part of the target, and with what thresholds. The security score, the action plan, the Compliance pages, the customer overview and reports all follow it.
Without an ideal state, a customer that deliberately doesn't use BitLocker on office desktops would lose points forever. With one, you leave that control out, record why, and the customer is measured on what you agreed.
The security score and the ideal state
The customer overview shows two numbers. They measure against the same ideal state, in two different ways:
| Security score (0 to 100, A to F) | Ideal state (%) | |
|---|---|---|
| What it is | How exposed the customer is | The checklist: how many of the ideal state's controls are fully met |
| What moves it | Every open problem, by its severity and by how much of the fleet it affects | A control flips to met only when it's done everywhere |
| Example | Firewall off on 2 of 34 devices costs a little; on 30 of 34, a lot | Host firewall on for every device isn't met until all 34 are done |
So fixing a problem on more devices raises the score steadily even while its control is still open. A perfect 100 means nothing the ideal state asks for is open; what you leave out of the ideal state never costs points, so 100 is reachable for every customer. Problems on part of the fleet count in proportion (a problem on one device in a hundred barely moves the score; the first few devices count the most), and an open critical problem caps the score (at 55 when it affects everything, much less on a single device of many). Low-severity items never take a customer below an A on their own.
Controls
Every check RevoSecure runs belongs to a control, such as MFA for every user, DMARC at reject, Disk encryption on every device or Security updates within the update window. Each control in a customer's ideal state is one of:
- Required: counts towards the score, compliance and reports.
- Left out: still checked and visible, but doesn't count. Leaving a control out for a customer needs a reason (for example "Desktops never leave the office").
Some controls have thresholds:
- the update window and critical limit for operating system updates;
- the security tools every Windows device is expected to have (for example ThreatLocker and Huntress);
- the minimum DMARC policy;
- who must have MFA, and the minimum sign-in strength for administrators;
- when an account counts as unused.
A threshold can leave another control out by itself. Setting the minimum DMARC policy to quarantine leaves out Move DMARC to p=reject; the page shows it as Left out by ….
Set a customer's ideal state
- Open the customer's Customer settings → Ideal state.
- Under Starting point, pick a template: Standard, Small office, Regulated or one of your workspace's own templates (see Ideal-state templates).
- Adjust single controls below it: set each to Required or Left out, and change thresholds.
- Check the preview before you save. It shows the effect on the score, open findings and ideal-state compliance, now and after the change.
- Save. Everything is re-measured at once.
To undo a change, set the control back to the template's setting. Filter the list by Left out or Customised, or search for a control.
Findings outside the ideal state
Findings that belong to a left-out control stay open and visible, marked Outside ideal state, but don't count towards the score, compliance or reports. On Findings they're hidden by default: Show N outside the ideal state brings them back. The action plan shows those controls as Not part of the ideal state, and Microsoft 365 user issues for those controls are marked the same way.
Compliance
Compliance shows how close customers are to their ideal state.
- In the portfolio, every customer is ranked by ideal-state compliance, with its trend, its biggest gaps and its template.
- In a customer, each control shows its status: met, partly met (with its coverage of devices, users or domains), not met, not yet evaluated, not applicable or left out, with links to fix it and a 90-day trend.
Only controls with evidence count. A customer is never marked down for data that hasn't been collected yet, and the page says how many controls aren't evaluated yet. Connect the missing source (the agent, Microsoft 365, an external assessment) to evaluate them.
The Ideal-state compliance and Portfolio compliance reports present the same data as PDFs (see Report types).
Who can change it
Technicians, admins and owners can set a customer's ideal state. Owners and admins manage templates. Every change is recorded in the audit log.