Skip to main content

KPIs

Key performance indicators (KPIs) derived from Compliance Engine data help you measure how effective your controls and remediation processes are.

Common KPIs​

Typical KPIs include:

  • Control pass rate – percentage of assets that are compliant for a given policy, pack, or framework.
  • Open violations – number of incompliant findings by severity, environment, or owner.
  • Mean time to remediate (MTTR) – average time from a violation becoming incompliant to returning to compliant.
  • Violation age – how long current open violations have been in the incompliant state.
  • Exception aging – how long risk‑accepted findings have been under exception.
  • Benchmark coverage – proportion of controls enabled vs. total available in a pack.

These metrics rely on the state model and timestamps described in State Model and Status Transitions.

Setting Targets​

Targets vary by organization, but common patterns are:

  • Minimum pass rates by environment (for example, stricter targets in production).
  • Maximum MTTR for high‑severity violations.
  • Limits on the number and age of exceptions.

By tracking KPIs over time, you can show improvements, detect regressions, and justify investments in remediation or automation.