Compliance Grades

Every completed scan gets a single-letter grade from A to D. The grade is count-based - it looks only at the number of critical and high findings on the scan. SLA timers and triage state are tracked separately and do not affect the grade.

The formula

if (critical > 0)  return "D"
if (high > 3)      return "C"
if (high > 0)      return "B"
return "A"

That is the entire computation. Medium, low, and unknown severity counts are ignored. Misconfigurations from Dockle do not affect the grade.

Grade table

Worked examples

The threshold between B and C is strictly high > 3, so 3 highs is still a B and 4 highs becomes a C.

Grade is not SLA

The A-D grade and SLA tracking answer different questions:

Two scans can both be grade B (one to three highs) while one has every finding within SLA and the other has every finding overdue. Conversely, a scan can be grade A while older scans of the same image have unresolved SLA-overdue findings - the grade only describes the snapshot in front of you.

SLA policy lives in Settings -> Compliance Policy and emits its own notifications (sla_warning, sla_breach). See Core Concepts.

Using grades

Common patterns:

• CI gate: fail the pipeline if the new scan's grade is worse than B. See CI/CD for an example.
• Trend line: the dashboard tracks grade-over-time per image to surface drift.
• Executive reporting: percent of images at A/B versus C/D maps cleanly onto a compliance chart.