Security-by-default scores for each CMS