A retail company runs workloads across Azure, AWS, and on-premises datacenters connected via Azure Arc. The security architect must design a posture management approach that produces a single, weighted percentage score reflecting how well the organization is following prescriptive security controls across all three environments, so leadership can track measurable improvement over quarterly review cycles. The solution must be based on the Microsoft cloud security benchmark control set and drive prioritized configuration recommendations. Which capability should the architect designate as the primary metric for this reporting requirement?