Chapter 3 — Measuring coverage
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 What to measure"]
N2["3.2 Data sources"]
N3["Lab — Coverage by device group"]
N4["3.3 Reading the table"]
N5["3.4 Presenting"]
N6["Validating the consoles and setting the rhythm"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 What to measure"]
N2["3.2 Data sources"]
N3["Lab — Coverage by device group"]
N4["3.3 Reading the table"]
N5["3.4 Presenting"]
N6["Validating the consoles and setting the rhythm"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 What to measure]
|
v
[3.2 Data sources]
|
v
[Lab — Coverage by device group]
|
v
[3.3 Reading the table]
|
v
[3.4 Presenting]
|
v
[Validating the consoles and setting the rhythm]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) measure controls by device group; (2) interpret coverage; (3) find the weakest areas.
3.1 What to measure
Seun measures four controls per device group: endpoint detection and response agent reporting, disk encryption, updates within fourteen days and full compliance with the standard. These cover detection, data protection, patching and configuration. Four controls are few enough to measure monthly and explain to non-specialists, yet each corresponds to something an insurer or auditor asks about. Measuring them per device group shows where each control is weakest, rather than giving one company-wide figure. Seun writes down exactly how each control is counted, such as what qualifies as an update installed within fourteen days, so later months use the same definition and figures can be compared over time.
3.2 Data sources
Figures come from the endpoint management and detection consoles. Seun first reconciles their device lists with the asset register, so that each percentage has a trustworthy denominator. Reconciling the lists finds devices that exist in the register but not in the consoles, and devices in a console that were retired long ago. Without this step, a missing device simply disappears from the percentage instead of counting as a gap. Seun keeps the reconciled list as the denominator for every monthly figure and repeats the reconciliation each month, so newly bought devices are counted from the start and retired ones are removed with a date.
Lab — Coverage by device group
"""Control coverage by device group from a synthetic management export (stdlib only)."""
groups = {"office laptops": (120, {"edr": 118, "encrypt": 112, "patch14": 101, "baseline": 84}),
"warehouse PCs": (40, {"edr": 31, "encrypt": 12, "patch14": 22, "baseline": 15}),
"Linux servers": (18, {"edr": 14, "encrypt": 18, "patch14": 13, "baseline": 9}),
"Windows servers": (12, {"edr": 12, "encrypt": 12, "patch14": 10, "baseline": 8})}
for g, (n, c) in groups.items():
print(f"{g:16} n={n:3d} " + " ".join(f"{k}={v/n*100:3.0f}%" for k, v in c.items()))
weak = min(((g, k, v / n) for g, (n, c) in groups.items() for k, v in c.items()), key=lambda x: x[2])
print(f"weakest cell: {weak[0]} / {weak[1]} at {weak[2]*100:.0f}%")
Run with python3 lab_coverage.py. Verified output:
office laptops n=120 edr= 98% encrypt= 93% patch14= 84% baseline= 70%
warehouse PCs n= 40 edr= 78% encrypt= 30% patch14= 55% baseline= 38%
Linux servers n= 18 edr= 78% encrypt=100% patch14= 72% baseline= 50%
Windows servers n= 12 edr=100% encrypt=100% patch14= 83% baseline= 67%
weakest cell: warehouse PCs / encrypt at 30%
3.3 Reading the table
Office laptops and Windows servers are in reasonable shape. Warehouse PCs are weakest: only 30 percent encrypted and 38 percent compliant. Linux servers have only half meeting the standard and 78 percent with the detection agent. The overall average would hide this; group figures show where effort is needed. The table confirms what the audit suspected but could not show: the problem is concentrated in particular groups rather than spread evenly. That makes the next step clearer, since effort can be targeted. Seun keeps the table as the month-zero baseline in the evidence pack.
3.4 Presenting
Seun shows the table to the operations director with a sentence per group. The director immediately asks why warehouse PCs are behind, which leads to the next chapter. Keeping the presentation to one table and a sentence per group makes it readable in a short meeting, and it focuses discussion on decisions rather than detail. Seun also shows how each figure was counted, so the director can trust the comparison between groups. The question about warehouse PCs is exactly the kind of discussion the table is meant to start: why one group lags, what it would take to improve it, and in what order Marlowe should act.
Validating the consoles and setting the rhythm
Consoles can be wrong. Seun asks the infrastructure team to check five devices from each group by hand against what the console reports. Two Linux servers show as compliant but have a setting changed locally after their last check-in, so the team shortens the reporting interval. He records this validation in the method notes so auditors can see the figures were tested, not just exported. The table is then produced on the first working day of each month, using the same exports and groups. A fixed rhythm makes trends comparable and lets owners plan, because they know when their figures will be seen.
Worked example
The warehouse encryption cell is the weakest at 30 percent; Seun finds most warehouse PCs are older models bought before encryption was standard.
Synthetic case. Figures are synthetic.
Errors and limits
Reporting one overall percentage hides weak groups.
Exercises
- EX011 — Four controls. Name the four controls measured. Rubric: 3 = all four;; 2 = three;; 1 = fewer;; 0 = none.
- EX012 — Denominator. Why reconcile with the asset register first? Rubric: 3 = trustworthy denominator;; 2 = accuracy;; 1 = vague;; 0 = none.
- EX013 — Weakest cell. What is the weakest cell and its value? Rubric: 3 = warehouse encryption 30%;; 2 = warehouse;; 1 = wrong;; 0 = none.
- EX014 — Averages. Why avoid a single overall percentage? Rubric: 3 = hides weak groups;; 2 = misleading;; 1 = vague;; 0 = none.
- EX015 — Linux view. Summarise the Linux server position. Rubric: 3 = 50% baseline, 78% EDR, 72% patch;; 2 = some;; 1 = vague;; 0 = none.
Synthesis
Coverage by group shows where the risk sits.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →