> For the complete documentation index, see [llms.txt](https://docs.cortex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.io/solutions/drive-framework/drive-scorecard-rules.md). # DRIVE Scorecard rules Cortex maps the DRIVE framework directly into a Scorecard with three performance levels: * **Bronze** - Baseline hygiene; the floor every team should clear. * **Silver** - Consistent performer; healthy teams operating well. * **Gold** - Engineering excellence; the standard high-performing organizations hold themselves to. Each rule in the Scorecard corresponds to a DRIVE pillar and uses live data from your connected integrations, with no manual data entry and no stale reports. [Refer to the documentation](/standardize/scorecards/create.md) for creating a Scorecard. ### Delivery Delivery measures both the structural and human capacity to sustain high performance. Deploy frequency and lead time for changes are the core DORA metrics here. On-call pager volume rounds out the picture by capturing the hidden cost of quality regressions on developers.

Level	Rules
Bronze	Deploying at least once per week. Average ≥1 deploy/week over last month.
Silver	Deploying multiple times per week. Average ≥3 deploys/week over last month.
Gold	Deploying daily or more. Average ≥5 deploys/week over last month.

**Example** - A team migrating to a new CI/CD pipeline sees their deploy frequency drop from 4x/week to 0 for two weeks. The DRIVE Scorecard catches this immediately as they slip from Silver to below Bronze, giving their engineering manager an early signal to unblock the migration before it becomes a reliability problem. **Critical metrics to track** - Deploy frequency, lead time for changes, on-call pager volume ### Reliability Reliability measures whether your product is living up to what you've promised customers. As AI makes it easier to write automated tests that give a false sense of confidence, grounding your reliability signal in SLOs and real incidents keeps the pillar anchored to customer reality.

Level	Rules
Bronze	SLO pass rate above 80%. Fewer than 5 incidents in the last 30 days.
Silver	SLO pass rate above 90%. Fewer than 2 incidents in the last 30 days.
Gold	SLO pass rate above 95%. Zero incidents in the last 30 days.

**Example** - The payment service has an SLO pass rate of 78%, just below the Bronze threshold. Instead of this surfacing in a postmortem three weeks later, it shows up at the next OpEx review as a clear Bronze failure, prompting the team to investigate whether the SLO itself needs refinement or the underlying service does. **Critical metrics to track** - Functional SLO status (binary pass/fail), Sev0/Sev1 incident count ### Initiatives Every engineering organization is running org-wide, non-product technical mandates at any given time—platform migrations, shared dependency upgrades, vulnerability remediations, compliance programs. These initiatives frequently get deprioritized in favor of feature work, stall quietly, and then surface as emergencies. DRIVE surfaces initiative progress at every OpEx review, making "we're at 60%" a visible, tracked fact rather than an invisible risk.

Level	Rules
Bronze	Initiative completion rate above 50%.
Silver	Initiative completion rate above 70%.
Gold	Initiative completion rate above 85%.

**Example** - A `log4j-equivalent` vulnerability is announced. Leadership kicks off a remediation initiative. Three weeks later, DRIVE shows that 18 of 40 services have been patched (45%, below Bronze). The Scorecard makes the gap visible to every level of leadership, and the team creates an Initiative to drive the remaining 22 services to completion. **Critical metrics to track** - Tier 1 initiative milestone completion rate, OpEx action item completion rate ### Vigilance With AI code generation expanding attack surface faster than ever, security and compliance can't be treated as periodic audits. Vigilance keeps these risks in the regular rhythm of engineering review, not as a compliance checkbox, but as a core indicator of organizational health. Orphaned assets (services and infrastructure with no verified owner) are included here because they are risk vectors with no human accountability.

Level	Rules
Bronze	Zero critical vulnerabilities.
Silver	Fewer than 5 high vulnerabilities.
Gold	Zero high vulnerabilities.

**Example** - After adopting an AI code generation tool, a team unknowingly introduces a dependency with a critical CVE. The Vigilance rules flag it within hours of the next Scorecard evaluation without requiring a manual scan. The team patches it before it's ever deployed to production. **Critical metrics to track** - Open Critical/High fixable CVEs, assets below the minimum compliance and security bar, orphaned assets ### Efficiency Efficiency measures whether resources like money and people are going where the organization intends. Cloud spend variance has always been a concern; with AI token costs now exploding for both developer tooling and customer-facing AI products, efficiency has a new dimension that most organizations aren't yet tracking systematically.

Level	Rules
Bronze	Cloud spend within 120% of budget. AI spend within 120% of budget.
Silver	Cloud spend within 105% of budget. AI spend within 105% of budget.
Gold	Cloud spend at or under budget. AI spend at or under budget.

**Example** - A team building a new AI-powered feature ships it with unbounded LLM calls. By the end of the first week, their AI token spend is at 140% of budget, above the Bronze threshold. The DRIVE Scorecard surfaces this in the next review cycle, prompting the team to add caching and rate limiting before costs compound. **Critical metrics to track** - Cloud spend vs. budget, internal AI/LLM token costs, percentage of capacity spent on innovation. ## Next steps Create a module and [build out your custom DRIVE dashboard](/solutions/drive-framework/building-a-custom-drive-dashboard.md).