What is the Digital Trust Score and how is it calculated?

Five cybersecurity areas

DTS groups the assessment into five areas. Each area can contribute up to 190 points, with a total scale of 950.

• External exposure: the organisation’s public surface.
• Internal cyber hygiene: maintenance and internal security practices.
• Compliance: assessed policies and procedures.
• Supplier risk: dependencies and third-party security.
• Resilience and response: preparation to respond and recover.

How the score is calculated

The engine uses scorable answers and weights defined by the questionnaire version. It normalises each area against its maximum and sums the contributions. The score is not simply the percentage of questions answered.

DTS Basic currently has a 700-point cap within the 950-point scale. When the cap applies, the engine adjusts area contributions. DTS Verified uses the full scale. Level labels depend on the tier, so comparisons must consider that context.

Provisional scores and pending assessments

Claiming a profile does not mean an assessment is complete. Without scorable information, the result remains pending. A score from an open assessment is provisional and can change.

Questionnaire completion and score measure different things. More answers do not guarantee a higher score: they may also reveal outstanding measures.

Identity, verification and validity

Verified identity confirms control of a profile. A NALLAM-verified assessment involves review of associated evidence and has its own status and validity. These are different checks.

Share the current public profile with customers. The badge and QR facilitate access; they must not hide an assessment in progress or an expired verification.

Interpreting sector comparisons

A percentile relates a score to the available comparable-company sample and is shown only when there is sufficient data. It is neither market share nor a guarantee of security.

DTS is not equivalent to ISO 27001 or ENS certification, nor proof of regulatory compliance by itself. It does not publish specific vulnerabilities or sensitive operational information. Other rating platforms may use different methods and scales.

Frequently asked questions