The security score is based on the following security settings per user:
Is a password required for the user?
Is the password non-reversible?
Does the password expire?
Is the password changeable?
Does the user get locked out after five or less bad password attempts?
Are passwords required to be at least 10 characters long?
Is there a password complexity requirement in place?
Each "yes" response is weighted evenly, so if you have 6/7 requirements, your security score would be 85.7.