Your encryption-at-rest control passes on 92% of the 60% of systems you can assess — how do you report it?

This is a reporting and governance question rather than a technical one, and it is where control programmes most often lose their integrity. The pressure is always toward one number that is green. ## Three ways the number gets faked, all of them without anyone lying **Shrink the denominator.** Narrow applicability until only well-managed systems remain in scope. The pass rate rises and nothing about the estate changed. **Fold unassessed into pass.** Usually accidental: the report counts what was evaluated, and what could not be evaluated contributes to neither number, so under-coverage silently flatters the result. **Blend into one figure.** Multiplying coverage by pass rate produces a number that looks conservative and is actually an unfounded claim — it treats every unassessed system as failing. It also destroys the separation that makes the report actionable, because a reader can no longer tell whether to fund access work or remediation work. ## The honest structure A control's line in the report has four parts: - **Population and its provenance** — how many systems the control applies to and which independent enumeration produced that figure. - **Coverage** — what fraction of that population was actually assessed this period, with the unassessed part broken out by reason. - **Pass rate within coverage** — stated explicitly as a rate over the assessed subset, never over the population. - **Exclusions** — what was declared out of scope, by whom, why, and when that decision expires. With 60% coverage, coverage is the headline. Pass rate is a real number but a secondary one: improving it while 40% of the estate is invisible is optimising the part you can already see. ## Scope reduction as a governed decision Sometimes the right answer genuinely is to shrink scope. A segment may be isolated, decommissioning, or genuinely outside the control's intent. That is a legitimate decision and it should be easy to make properly and hard to make quietly. Properly means: a named approver with the authority to accept the residual risk, a written rationale, any compensating measure recorded alongside it, an expiry date, and the exclusion visible in the same report as the coverage figure so nobody has to go looking for it. Quietly means someone removes an account from a collector's configuration and the coverage percentage improves. The difference between those two is the entire difference between a control programme and a reporting exercise. ## When leadership wants the single number anyway They often do, and refusing outright is not a strategy. What works is attaching the qualifier so tightly to the number that they cannot travel separately: one figure with the coverage stated in the same breath, in the same cell, in the same slide line. It also helps to give leadership a metric they can actually move. Coverage responds to organisational action — mandating that new accounts are created through the provisioning path, assigning owners to unowned accounts, funding the access work — in a way that a pass rate does not, so making coverage the tracked commitment for a quarter or two is usually both more honest and more useful. ## The incentive trap Every improvement in visibility makes the numbers look worse. Discovery adds systems to the denominator, and the newly discovered systems are the least well configured, so both coverage and pass rate dip at the moment the programme is working best. If the reporting culture punishes that dip, teams learn not to look. The countermeasure is to report population growth as a positive line in its own right, to compare like-for-like against the previous period's population when discussing the pass rate, and to say explicitly at the time that a dip caused by discovery is the expected shape of a programme that is improving. ## What a reviewer will ask Anyone reviewing the control, internal or external, will eventually ask how you know the population is complete. 'Our tooling reported 98%' is not an answer to that question; 'here is the independent enumeration, here is the reconciliation against it, here is the unassessed bucket with owners and dates' is. Being able to produce that is worth more than a higher percentage, because it is the thing a percentage cannot demonstrate on its own.