Security finding data quality and completeness workflow
one defensible record per finding across every required field

Open findings where any required field is blank. Severity blank, status blank, affected asset blank, category blank, description blank, remediation blank, assigned owner blank, CVSS score blank. The cohort is the inventory of records the schema rejects. The hygiene cycle starts here because every other repair needs a defensible base.

Findings with a non-null CVSS score and a null CVSS vector. The calibration is not reproducible from the record so the audit lookback cannot verify the prioritisation read. The vector reconstructs from the source documentation or the calibration rule and the activity log carries the reconstruction event.

Open findings whose category does not match the controlled vocabulary. The reporting view counts the same category multiple ways and the recurring-pattern detection misses systemic issues because the join key drifts. The cleanup maps each drift value onto the canonical category and the activity log carries the rewrite.

Open findings assigned to owners who are no longer in the workspace, no longer on the engagement, or no longer in the role required to act. The cohort surfaces against the team management active-membership list. Reassignment runs against the routing rule and the previous owner stays in the activity log for accountability.

Open findings against assets that do not resolve on the verified domain list, the engagement scope, or the repository connection list. The cohort surfaces against the live asset inventory join. Each finding either gets the live asset reference or gets closed against the asset decommissioning workflow with a cited closure narrative.

Findings where resolved_at is set, verified_at is null, and the engagement type requires verification. The cohort is the boundary between an engineering assertion and a security confirmation. Each finding either gets a verification source attached through retesting or gets recorded as a closure-without-verification with cited rationale.

Open findings whose title, category, control reference, and affected asset match another open finding closely enough that they probably describe the same underlying issue. The cohort feeds the merge and supersede workflow rather than getting closed silently. The merged primary keeps the closure narrative and the duplicates attach as evidence.

Open findings whose control_ref does not match the canonical framework crosswalk for the engagement. NIST SI-2 versus NIST 800-53 SI-2, SOC 2 CC7.1 versus CC7-1, ISO A.8.8 versus A 8.8. The cleanup collapses each drift onto the canonical reference so the GRC view stops double-counting and the audit evidence assembles without manual reconciliation.

Healthy posture

The intake workflow enforces required fields at create time so nothing reaches the open queue with a blank essential field. Bulk imports map every column and reject the upload when required fields are missing in the source CSV. Manual finding creation surfaces the missing field at the validation step so the security analyst lands it complete rather than promising to come back.

Failure mode

The team treats required fields as a guideline rather than as a schema. Bulk imports leave severity blank because the source export did not include it. Manual creations land with a placeholder description that nobody updates. The hygiene queue grows linearly with the ingestion volume and the leadership view reports a number that overstates the working inventory.

Healthy posture

The category vocabulary is a documented list mapped to CWE identifiers, the engagement type lists the active categories, and the intake validates against the list. The reporting view groups against the canonical list so the recurring-pattern detection reads accurate counts.

Failure mode

The category vocabulary lives in a security engineer's memory. Findings arrive with whatever label the source emitted. The reporting view shows SSRF, server-side request forgery, SSRF (CWE-918), and CWE-918 as four separate categories. The leadership read undercounts the systemic risk because the join key drifts.

Healthy posture

The affected asset references resolve against the verified domain list, the engagement scope, the repository connection list, or a canonical asset identifier (container image digest, package coordinate). The cross-engagement view groups findings by asset because the reference is reliable.

Failure mode

Affected asset values are free text. "api.example.com", "API endpoint at example dot com", and "Production API server" describe the same asset across three findings and the cross-engagement view treats them as three different assets. The asset-owner routing reads from a field the routing key cannot rely on.

Healthy posture

Assigned owners get validated against active workspace membership and against the engagement access list on a recurring cadence. Owners who lose access get flagged for reassignment before the next SLA breach calculation runs. The named owner field is current at every cycle.

Failure mode

Findings stay assigned to whoever picked them up first. The owner leaves the company; the finding stays assigned. The owner moves teams; the finding stays assigned. The SLA breach escalation lands in a mailbox nobody reads. The next leadership read shows the SLA hit rate against names that cannot act.

Healthy posture

Every finding with a CVSS score carries the full vector. The vector includes the base metrics and, where calibrated, the temporal and environmental metrics. The score derives from the vector so anyone reading the record can reproduce it.

Failure mode

CVSS scores live without vectors. The calibration is not reproducible. The audit lookback reads scores without provenance. The leadership briefing cites the score as if it were canonical when the calibration that produced it was a single security engineer's judgment that nobody captured.

Healthy posture

The closure record carries the verification source (follow-up scan, retest evidence, code change link, configuration audit), the verified_at timestamp, and the named verifier. The audit reads the closure as a defensible record rather than as an assertion.

Failure mode

Findings get marked resolved on the strength of an engineering claim. The closed queue grows without verification evidence. The next assessment asks for proof and the security team reconstructs the evidence after the fact from chat logs, scanner exports, and whatever the engineering team remembers.

Healthy posture

Every field change lands as a structured event on the activity log with the previous value, the new value, the timestamp, the user, and the cited rationale where the change is a calibration, an override, or an exception. The audit lookback reads the rewrite history with attribution.

Failure mode

Field changes happen through bulk edits without recorded rationale. The audit lookback can see that severity changed from High to Medium but cannot reconstruct why. The reviewer treats the record as untrustworthy because the rewrite history is opaque, and the assessor extends the audit to compensate.

Findings with blank severity get severity from the calibration rule: source severity recalibrated against asset criticality and deployed exposure. Findings with a score and no vector get the vector reconstructed from the calibration rule and the source documentation. Findings where the score and the vector disagree get the vector preserved (it carries the metric set) and the score recomputed. Each repair lands as a structured state event with cited rationale so the activity log captures the calibration provenance.

Free-text category values map onto the controlled vocabulary through a documented rewrite list. Control references drift values map onto the canonical reference. The rewrite runs as a structured field update with the previous value preserved on the activity log so the audit lookback can reconstruct the cleanup history. The reporting view stops double-counting because the join keys are stable.

Affected asset references resolve against the verified domain list, the engagement scope, and the repository connection list. References that point at retired assets get closed against the asset decommissioning workflow with cited closure narrative. References that drift on a still-live asset get rewritten to the canonical reference. The hygiene rule is no open finding survives a cycle with an asset reference the live inventory does not recognise.

The assigned_to field cross-joins with the active workspace membership and the engagement access list. Findings assigned to inactive owners route to the new named owner through the security finding ownership and routing workflow. The previous owner stays in the activity log for accountability and the routing decision lands as a structured event. The named owner field is current at every cycle so downstream views read against a defensible routing key.

Duplicate identities feed the merge and supersede workflow rather than getting silently closed. The merged primary carries the closure narrative and the duplicates attach as evidence. Orphan findings against deleted assets get closed against the asset decommissioning workflow with a cited closure narrative. The hygiene cycle ends with the open queue containing only findings the audit lookback can defend.

Findings with resolved_at set and verified_at null on engagements that require verification either route to retesting (preferred path) or get recorded as a closure-without-verification with cited rationale. The closed queue distinguishes verified closures from asserted closures so the audit lookback can read the verification posture against the right denominator.

The proportion of open findings where every required field is non-null. The single most predictive signal of audit defensibility. A working programme stays above the documented threshold (typically 95 percent or higher) on a recurring cadence rather than only before an assessment.

The proportion of findings with a non-null score where the vector is also present and the score derives from the vector. The signal that distinguishes a calibrated severity programme from one that reads scores without provenance.

The proportion of open findings whose category and control reference match the canonical vocabulary and crosswalk. The signal that distinguishes a programme whose reporting reads accurate counts from one whose join keys silently drift.

The proportion of open findings whose assigned_to value resolves against active workspace membership and active engagement access. The signal that distinguishes a programme whose routing is defensible from one whose SLA calculations report against names that cannot act.

The proportion of open findings whose affected_asset value resolves against the live inventory (verified domain list, engagement scope, repository connection list). The signal that distinguishes a programme whose cross-engagement view reads against a stable asset ground truth from one whose asset references drift silently.

The proportion of closures with both resolved_at and verified_at populated. The signal that distinguishes a programme whose closed queue holds defensible records from one whose closures are engineering assertions the audit cannot verify.

The hygiene workflow depends on vulnerability finding intake for the front-door discipline, vulnerability finding state lifecycle for the documented status transitions, security finding ownership and routing for the named-owner refresh, asset ownership mapping for the asset reference resolution, and CVE and EPSS enrichment for the upstream advisory metadata layer.

Hygiene-disciplined records feed merge and supersede for duplicate collapse, asset decommissioning and finding retirement for orphan closure, vulnerability backlog management for the working queue read, security debt portfolio management for the portfolio view, audit fieldwork evidence request fulfillment for the assessor binder, and security leadership reporting for the recurring leadership read.