liveBook · Manning

Compliant document ratio

As explained in Data-Driven Cybersecurity

The proportion of assessed entities or activities that satisfy specified requirements.

The compliant document ratio is the share of assessed policies and procedures that meet applicable requirements. Comparing compliant with noncompliant documents shows where document-control work is needed; it does not, by itself, explain why a document failed. section 5.5.1

Use the ratio to decide what to investigate next:

  • Compare it with the target and past performance, then identify which documents remain noncompliant. section 5.5.1 section 5.5.2
  • Check review completion and time to update documents. A completed review is not the same as a compliant document, and approval delays may call for a longer review window or different resources. section 5.5.1 section 5.5.2

A documentation dashboard decision

After an audit exposed outdated policies, MediHealth Solutions set a documentation-compliance target of at least 90%. Its dashboard shows 75% compliance alongside 98% annual review completion. The 15-percentage-point compliance gap calls for investigating outdated or misaligned documents, even though nearly all reviews are complete. Critical documents also need prompt review when regulations change. section 5.5.2

Figure 5.8 The left side shows an example policy and procedure dashboard for MediHealth Solutions depicting the need for policy and procedure improvements. On the right is the dashboard for MediHealth Solutions after implementing a formal document control process to update policies and procedures periodically.

Compare the policy-and-procedure dashboards before and after a formal, periodic document-control process; use the compliance result to identify remaining work rather than treating process improvement as full compliance. section 5.5.2

How Data-Driven Cybersecurity covers it

How deep it goes
Defines a compliant-versus-noncompliant comparison and interprets dashboard results, but does not specify a document-level scoring method.
Examples
Uses a policy-and-procedure dashboard showing 75% documentation compliance against a target of at least 90%.
What you can do after
Evaluate/understand it: distinguish review completion from compliance, identify the gap to target, and prioritize document updates.
How it connects
Connects document compliance to annual document review, update time, regulatory standards, and audit risk.

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.