Metrics
Coverage metrics
The first to look at: they tell you whether the arrangement exists.
| Metric | Target | Source |
|---|---|---|
| Share of products qualified as PDEs | 100 % | Qualification register |
| Share of products classified | 100 % | Classification register |
| Share of products with an automated SBOM | 100 % of active products | Platform |
| Share of SBOMs above the quality threshold | 100 % | Platform |
| Share of products under continuous monitoring | 100 % of shipped versions | Platform |
| Share of products with a declared support period | 100 % | Register |
| Share of products with complete technical documentation | 100 % before market entry | Compliance tracking |
| Share of class II / Critical products with a notified body engaged | 100 % | Register |
Performance metrics
They tell you whether the arrangement works.
| Metric | Indicative target |
|---|---|
| Median detection interval (publication → your alert) | < 24 h |
| Median triage interval (alert → decision) | < 5 days |
| Median remediation interval, by severity | Per SLAs |
| Share of SLAs met | > 90 % |
| Average age of open vulnerabilities | Steadily falling |
| Ratio of actionable alerts to raw alerts | Steadily rising |
| Interval achieved at the last reporting exercise | < 12 h for the early warning |
| Interval achieved at the last retrieval exercise | < 1 working day |
Risk metrics
They tell you what remains exposed.
| Metric | Meaning |
|---|---|
| Number of components at end of maintenance inside supported products | Direct regulatory liability |
| Number of single-maintainer components in critical products | Takeover or abandonment risk |
| Number of licences out of policy, with no active exception | Intellectual property risk |
| Number of expired exceptions not dealt with | Process defect |
| Number of support periods with a limiting component ending earlier | Untenable commitments |
| Estimated financial exposure | See Exposure |
Readiness metrics
| Metric | Source |
|---|---|
| Days remaining before each legal deadline | Timeline |
| Back-planning progress, by wave | Roadmap |
| Date of the last reporting exercise | Exercise reports |
| Date of the last retrieval exercise | Exercise reports |
| Self-assessment score by module | Quarterly assessment |
Metrics not to track
| Misleading metric | Why |
|---|---|
| Number of vulnerabilities detected | It rises as the arrangement improves. Presenting it to a committee creates a perverse incentive to detect less. |
| Number of SBOMs generated | Without coverage and quality it is a file counter. |
| Number of alerts closed | Closing an alert without handling it removes it from the counter. |
| Overall security score | A non-actionable aggregate that hides variation between products. |
Leadership dashboard mock-up
One page, four blocks.
┌──────────────────────────────┬──────────────────────────────┐
│ COVERAGE │ DEADLINES │
│ │ │
│ Products classified ██ % │ Reporting operational ✓ │
│ SBOM automated ██ % │ Full application: D-___ │
│ Monitoring active ██ % │ Notified bodies __/__ │
│ Files complete ██ % │ Back-planning: wave __/6 │
├──────────────────────────────┼──────────────────────────────┤
│ PERFORMANCE │ OPEN RISKS │
│ │ │
│ Critical remediation __ d │ Abandoned components __ │
│ SLAs met __ % │ Licences out of policy __ │
│ Last 24 h exercise __ h │ Untenable support __ │
│ Actionable alerts __ % │ Estimated exposure __ €m │
└──────────────────────────────┴──────────────────────────────┘
Decisions required from the committee: …The keeping rule
Every metric has a named owner, a single source and an update frequency. A metric computed by hand the day before the committee is not a metric: it is an estimate.