Compliance as Code

Report both numbers separately, never their product and never the flattering one alone: coverage of the estate, and pass rate within that coverage. Name what is unassessed and who owns closing it, with a dated plan to raise coverage first.

You cannot assert trustworthiness; you engineer it. Split the paths so the team that operates the control cannot silently alter, delete or forge its evidence, and let someone outside the team verify a sample independently.

Not the person asking for it. Approval should sit with someone accountable for the risk rather than the deadline, and authority should scale with how wide and how long the exception is.

Treat the 400 as the pre-existing state finally becoming visible, not as 400 new problems. Freeze them as a known baseline, hold the team only to what appears after today, group by root cause, and validate a sample before anyone sees the number.

Decide per control, using its decay rate. A few decay fast enough to justify moving them off the host or rebuilding rather than repairing; for the rest, accept decay and claim periodic verification, not continuous enforcement.

Choose between a central runner holding credentials to every host and a local agent that ships only results, scope the privilege to reads, keep assessing separate from remediating, and measure coverage against an inventory so unassessed hosts never read as compliant.