Metrics to prove progress
Trust Architecture Playbook: Baseline pillar
Measuring the effectiveness of a certificate discovery program requires metrics that are tied directly to program outcomes rather than operational activity alone. The following framework organizes key indicators across four domains, each designed to demonstrate meaningful progress toward a mature, well-governed certificate inventory.
Coverage and unknown reduction
Count of certificates with unknown owner (trend down).
Percent of critical services covered by at least two discovery methods.
Count of certificates missing mandatory tags (trend down).
Mis-issuance detection
New CT discoveries per week.
Percent of CT discoveries reconciled to a known owner and issuance channel within SLA (for example, 48 hours).
Crypto hygiene
Percent of inventory failing crypto policy checks, segmented by external vs internal.
Count of high-severity crypto exceptions for Tier 0/Tier 1 services (trend down).
Automation readiness
Percent of Tier 0/Tier 1 certificates mapped to an automation-capable platform (connector/agent-managed).
Backlog size of automation candidates not yet automated (input to automation planning).