Calculating the security score for password reset process

---
title: Calculating the security score for password reset process
description: The security score of the password reset process is a critical metric for the password reset administrators to assess the strength and configuration of the password reset process.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/servicenow-platform/password-reset/pwd-reset-process-recommend.html
release: australia
product: Password Reset
classification: password-reset
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 3
breadcrumb: [Configure your Password Reset process, Configuring Password Reset, Password Reset, Manage service capabilities, Extend ServiceNow AI Platform capabilities]
---

# Calculating the security score for password reset process

The security score of the password reset process is a critical metric for the password reset administrators to assess the strength and configuration of the password reset process.

## Password reset calculation

The password reset process score provides a quantitative measure of how well the process is configured to protect against unauthorized access and confirm that only legitimate users can reset their passwords. The score is based on the following categories:

-   Identification score \(Max: 20 points\)
-   Verification score \(Max: 40 points\)
-   Configuration score \(Max: 20 points\)
-   Password policy score \(Max: 20 points\)

## Identification score

To increase your identification score, you must enable multiple identification methods. If you’re currently using only one method, such as a username, adding another method like an email can increase your score by approximately five points. Additionally, enabling CAPTCHA adds 10 points to your score and help to prevent the bots from exploiting the password reset flow.

## Verification score

To achieve a high score, you must use at least two verification methods with medium or high security levels. Each method adds up to 15 points \(medium\) or 25 points \(high\).

For the custom verification types, you must assign the security level. By default the custom verification is set as **low**.

## Configuration score

To optimize your score, enable either the Email/SMS Password Reset URL or auto-generate passwords. If neither is enabled, the score is set at 10 points. Enabling either of these options fetches 20 points.

## Password Policy Score

To maximize your Password Policy Score, enable the Password Policy on the Credential Store if it isn’t active. Implement the Enforce History Policy to prevent users from reusing their last five passwords as defined in the **password\_history\_limit** property. Use a **High** strength password policy and enable the following settings:

**Send password reset process security score notification** is a weekly job that send reminders to the password admin about the score and recommendations to improve the score. An email notification is sent to the Process Owners of all the active processes if **Enable security score notification** option is selected in Password Reset Process form.

**Parent Topic:**[Configure your Password Reset process](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/password-reset/t_CreateAPasswordResetProcess.md)

**Related topics**  


[Configure password expiration reminder]()

[Credential stores for Password Reset]()

[Password Reset verifications]()

[Configure your Password Reset process to auto-enroll users]()

[Enable users to enroll for Password Reset]()

[Configure Password Reset properties]()

[Send email to remind users to enroll for Password Reset]()

[Configure the required strength for passwords]()

[Specify lockout for failed login attempts]()

[Configure Google reCAPTCHA for the password reset process]()