| AAA | All information security and/or privacy controls are adequate, appropriate, and effective enough to provide reasonable assurance that security and/or privacy risks are being managed, and objectives are met. | Excellent | None to minimal |
| AA | Almost all information security and/or privacy controls are adequate, appropriate, and effective enough to provide reasonable assurance that security and/or privacy risks are being managed, and objectives are met. | Very good | Very low |
| A | Main information security and/or privacy controls are adequate, appropriate, and effective enough to provide reasonable assurance that security and/or privacy risks are being managed, and objectives are met. A few specific control weaknesses have been noted. Minor additional work to strengthen controls is recommended. | Good | Low |
| BBB | Main information security and/or privacy controls are adequate, appropriate, and mostly effective. A few specific control weaknesses have been noted. Minor additional work to strengthen controls is recommended. | Satisfactory | Low |
| BB | Main information security and/or privacy controls are adequate and appropriate, but effectiveness is uneven. Some specific control weaknesses have been noted. Major additional work to strengthen controls is recommended. | Sufficient | Moderate |
| B | Some information security and/or privacy controls are adequate, but many are not. Many specific control weaknesses have been noted. Major additional work to strengthen controls is highly recommended. | Moderate | Moderate |
| CCC | Main information security and/or privacy controls are unlikely to provide reasonable assurance that security and/or privacy risks are being managed. Major additional work to strengthen controls is highly recommended. | Insufficient | High |
| CC | Almost all information security and/or privacy controls are unlikely to provide reasonable assurance that security and/or privacy risks are being managed. Major additional work to strengthen controls is highly recommended. | Very Insufficient | High |
| C | Almost all information security and/or privacy controls are unlikely to provide any assurance that security and/or privacy risks are being managed. Major additional work or a completely new program is required. | Poor | Very high |
| D | All information security and/or privacy controls are not providing any assurance that security and/or privacy risks are being managed. A complete new program is required. | Very poor | Almost certain |