Metrics to prove progress
Trust Architecture Playbook: Governance pillar
Measure governance outcomes
Governance metrics should measure control effectiveness, not administrative volume. Certificate counts and profile counts are useful inventory facts, but they do not prove governance. The useful questions are whether the estate is owned, constrained, authorized, observable, evidenced, and improving.
Segment every metric by tier, business unit, trust domain, CA source, profile, platform, and environment.
Separate coverage metrics from reliability and evidence metrics.
Treat exception age, profile sprawl, access drift, and unapproved CA sources as leading indicators of governance failure.
Report governance risk to leadership in operational terms: outage risk, trust risk, audit exposure, and crypto-agility readiness.
Core metrics
The following table defines each governance metric, including how it is measured, what a healthy signal looks like, and how to segment it for meaningful analysis.
Metric | Definition | Healthy signal | Segment by |
|---|---|---|---|
Owned certificate coverage | Percent of certificates with assigned business and/or technical owner. | 100% for Tier 0/1; trending to 100% overall. | Tier, BU, platform, trust domain |
Profile compliance coverage | Percent of certificates issued from approved profiles and CA sources. | 100% for production; exceptions time-boxed. | Profile, CA source, environment |
Unapproved CA source count | Number of certificates or endpoints tied to CA sources not in registry. | Zero in production; declining remediation backlog. | Trust domain, platform, BU |
Profile sprawl index | Count of active profiles by use case and duplicate/unused profiles. | Declining duplicates; unused profiles retired. | Profile owner, CA source, BU |
High-privilege access review completion | Percent of high-privilege users/service users reviewed on schedule. | 100% reviewed; removals tracked. | Role, BU, service user, account |
Exception volume and age | Open exceptions and average/max age. | Declining; no expired exception without decision. | Tier, BU, platform, reason |
CT anomaly reconciliation | Percent of CT log findings reconciled to owner/issuance path within SLA. | Near 100% within SLA for monitored domains. | Domain, issuer, owner |
Evidence completeness | Percent of sampled lifecycle events with complete evidence pack. | High and improving; no Tier 0/1 gaps. | Profile, tier, lifecycle action |
CA source review completion | Percent of approved CA sources reviewed on schedule. | 100%; dormant/legacy sources retired. | Trust type, owner, connector |
Crypto-agility readiness | Percent of Tier 0/1 services that can rotate keys/CA/algorithm within target RTO. | Increasing toward target; exercise failures remediated. | Tier, platform, trust domain |