Skip to content

Certified scope

What your management system's certified scope covers, and how much of it carries current evidence.

Why this screen exists

A tool that measures its own coverage always reports one hundred per cent. Every other screen answers a question about the targets somebody registered here. A management system has a scope declared in a document, and the two are not the same set.

An estate scanned in full, made of half the certified assets, reads as a clean result — and no query inside the product can notice it. That is the gap this screen is for.

The certified scope: forty assets declared against thirty-one held, and the share of the declared scope carrying fresh evidence.

The number at the top is about what is missing

"Your scope names forty assets, this instance holds thirty-one" is the sentence an audit begins with. It cannot be derived: the declared count is copied from your scope document into the settings — Administration → Settings & SLAs, card Retention & Purge, field Assets the certified scope covers — beside Certified scope, the scope statement itself. The Certified scope entry under Compliance & evidence in the navigation is this screen, which reads them.

The scope statement is stored so that an evidence bundle carries the scope it describes. An archive whose reader has to be told separately what it was about is half an archive.

Nothing is in scope by default

A scope nobody has drawn is an undrawn scope, not the whole estate. Until a count is declared the screen says not declared rather than producing a percentage against an unknown denominator.

That distinction matters more than it looks: zero missing assets and complete coverage produce the same number, and telling them apart is this screen's entire value. An undeclared scope reports no gap for the same reason an empty room reports no noise.

Putting a repository or an image in or out of the scope is recorded in the audit log as CERTIFIED_SCOPE_CHANGED, with who did it. Taking a target out is the quietest way to improve the coverage figure, so it is the change an assessor will want to see; saving a target where it already was records nothing.

Fresh evidence, against the declared total

The coverage share is computed against the declared count, never against what the instance holds. Dividing by what you have is exactly how a tool announces one hundred per cent over a tenth of an estate.

"Fresh" is governed by the compliance freshness window in Settings: past that many days a scan stops counting as a current observation, and a control assessed on incomplete coverage becomes not assessed rather than compliant.