To further clarify the Creative Commons license related to the 20 Critical Controls content, (i) All persons are authorized to use the content as a framework in their organization or to sell professional services related to the content (. a consulting engagement to implement the 20 Critical Controls), and (ii) sale of the contents as a framework model is not authorized. Users of the 20 Critical Controls framework are also required to refer to https:///critical-security-controls/ when referring to the 20 Critical Controls in order to ensure that users are employing the most up to date guidance.
Then, CWSS was used to evaluate each voter's assessment of a nominee, filling in the appropriate weights for prevalence, importance, and likelihood of exploit; the remaining 15 factors were all assigned ""Not Applicable" values, which reduces the impact of those factors on the final score. Due to how the CWSS formula is constructed, the use of "Not Applicable" values required a one–step normalization of a raw score to produce a final score that fell within the range of 0 and 100. In the CWSS formula, with the three active factors, the final score is most affected by importance, then prevalence, then likelihood of exploit.