does not measure a system’s vulnerability to attack or its overall level of
security risk. Nevertheless, building and configuring a system to lower its
RASQ score will reduce the number of potentially vulnerable attack surfaces,
thereby reducing its overall risk level.