A customer's contract cites your hardening benchmark percentage — should you re-rank the standard's items?

## The decision Somebody outside your organisation is consuming a number: a customer's contract, an insurer's questionnaire, a leadership dashboard. Internally you know the number is an unweighted count over a list written for every reader of the platform, and that a dozen of its items carry nearly everything an adversary would care about in your estate. The tempting move is to re-weight the list so the number tracks reality. This question is about why that is usually the wrong call, and what to do instead. ## Why re-ranking the published list destroys its value - **The number's meaning is external.** "We follow this published standard" is a statement the reader can check against other organisations, other years and their own environment. "We follow this published standard, re-weighted by us" is a statement about your opinion, and the reader has no way to price it. In the worst reading it looks like the weights were chosen after seeing which items failed. - **You inherit maintenance.** Published standards are revised as the platform changes: items are added, split, retired. A fork must be reconciled with every revision by somebody in your organisation, forever, for a document that currently costs you nothing. - **You lose the year-over-year line.** A re-weighted score is not comparable with last year's score under the old weights, so the one thing the number was reliably good for — drift — goes away too. - **It solves the wrong problem.** The defect is that nobody sorted the failing items, and a weighting scheme hides that rather than fixing it: the same argument about which items matter now happens once, in private, and is then frozen into arithmetic nobody re-examines. ## What to do instead Run two numbers with different jobs. 1. **The published percentage, unmodified**, for the outside. It is comparable, it is cheap, and it detects drift. Report it as what it is: agreement with a broadly applicable settings list. 2. **A named load-bearing subset**, for the inside. A short, explicit list — for a Kubernetes estate, the node agent's authentication and authorization path, the scope granted to workload identities, whether credentials handed to workloads are short-lived and bound, and whether the admission path will accept a workload asking for the host filesystem or host namespaces. Track this at 100%, item by item, with an owner. A failure here is an incident-shaped conversation; a failure in the wider list is a backlog item. The rule that keeps this honest: **the outward number may never be reported without the subset's condition next to it.** The whole reason organisations drift into scoring games is that a single flattering number travels further than a nuanced one. ## The organisational parts, which are the actual content of this question - **Who chooses the subset.** Not the platform teams who must do the work — that is marking your own homework in the direction of less work. Not the outside standard's author, who does not know your estate. In practice a small group that includes whoever owns the adversary picture, with the subset published so anybody can argue with it. - **Who may declare an item non-applicable.** "We do not operate that control plane" is a legitimate and common statement, and it is also the easiest sentence in the world to abuse. It needs a named person and a written reason, and it needs to be revisited when the estate changes — an organisation that starts running its own nodes has just made a hundred dormant items live. - **What you tell the customer when the contract demands 100%.** The honest answer is that some items govern components you do not run and settings that do not exist in your distribution, and that you will commit to the load-bearing subset at 100% plus the published percentage as-measured. That is a negotiation with a stated reason. Manufacturing conformance on items that mean nothing in your estate costs real engineering time and buys the customer nothing they wanted. - **What happens when leadership asks for the number to go up.** Say what a point costs and what it removes. If the next eight points are naming conventions on a component you do not run, that is a quarter spent on a rounder figure — and if the load-bearing subset is not at 100%, the same quarter has an obvious better home. ## The judgment being tested An interviewer is checking whether you can hold two truths at once: the published number is a poor proxy for exposure **and** it is worth keeping exactly as published. Candidates who only see the first want to redesign the standard; candidates who only see the second defend the percentage as if it meant something. The lead's answer keeps the outside number outside, builds the honest list inside, and makes sure neither one can be quoted without the other.