05 / 08 of 8
Sincerity
pronounced mah-koh-toh
Domain: Data integrity and truthful reporting
Report what is, not what is comfortable.
Make the system tell the truth.
Security decisions depend on the accuracy of the information behind them.
An inventory must represent the assets that actually exist. Logs must represent what actually happened. Configuration records must represent the deployed state. Integrity controls must detect unauthorised changes.
A dashboard showing 100% compliance is useless if the underlying inventory is incomplete.
A security control cannot compensate for false information upstream.
A dashboard tuned until it shows green.
When Makoto is absent, dashboards become fiction. Asset counts are wrong. "No alerts" means "no telemetry." Compliance percentages hide missing data.
Make the behaviour explicit and repeatable.
Define authoritative sources
Identify which system is authoritative for assets, identities, vulnerabilities, configurations and other security data.
Define data ownership
Assign owners to important security datasets.
Record freshness
Make the age of security data visible.
Distinguish unknown from compliant
Do not treat missing telemetry as a passing result.
Document measurement limits
State what each security metric includes and excludes.
Embed the behaviour into processes and ownership.
Reconcile inventories
Compare CMDB, cloud inventories, endpoint platforms, vulnerability scanners and network discovery.
Monitor security telemetry
Detect when log sources, agents, scanners or integrations stop reporting.
Validate critical metrics
Check the underlying data behind important dashboards.
Protect security records
Restrict modification and deletion of logs, evidence and audit records.
Establish data-quality workflows
Assign discrepancies to owners and track them to resolution.
Verify that the behaviour is happening and that it works.
Measure inventory coverage
Track the percentage of assets represented across required security systems.
Measure telemetry coverage
Track which critical systems are actually producing the expected logs.
Measure data freshness
Identify security data that has become too old to support decisions.
Sample compliance claims
Test whether reported compliance matches actual configuration.
Track reconciliation gaps
Measure recurring differences between authoritative and operational datasets.
Use evidence to improve the behaviour and respond to change.
Automate reconciliation
Continuously compare inventories and security platforms.
Detect silent failure
Alert when a security control stops producing expected evidence.
Propagate data quality
Prevent incomplete or stale source data from being presented as authoritative downstream.
Link metrics to evidence
Allow important security claims to be traced back to the underlying records.
Make uncertainty operational
Use confidence and coverage information when prioritising security decisions.
The CMDB reports 12,000 servers.
The vulnerability platform sees 14,700 assets.
The security team does not claim 100% scanning coverage.
They reconcile the inventories and identify the missing systems.
You cannot measure security coverage against an inventory you do not trust.
The SIEM shows no authentication failures for a critical application.
The team assumes the application is healthy.
During an investigation they discover that the application stopped forwarding logs three weeks earlier.
The absence of evidence was mistaken for evidence of absence.
A silent sensor is not a clean system.
A dashboard shows 95% of critical vulnerabilities remediated.
The underlying tickets show that several vulnerabilities were marked "accepted" rather than fixed.
The metric is redesigned to distinguish remediation from risk acceptance.
Do not let the dashboard hide the difference between fixing risk and recording risk.
Servers report compliant CIS configurations.
A spot check finds that the compliance agent is not running on several production servers.
The organisation changes the control to distinguish "compliant" from "not reporting."
A missing measurement must not become a passing measurement.
During an incident, several teams provide different timestamps for the same event.
The incident commander reconstructs the timeline from authoritative logs rather than relying on recollection.
The actual initial compromise is identified six hours earlier than originally believed.
When the facts matter, verify them against evidence.
Reading: Makoto has two halves — machine truth (hashes, checksums) and human truth (reporting the breach you would rather not) — and both belong here.
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| PR.DS-01 | Confidentiality, integrity, and availability of data at rest | direct | Integrity checks on data at rest are machine truth — the system reporting its own state honestly. |
| RS.CO-02 | Incidents reported to internal and external stakeholders | direct | Notifying stakeholders of an incident is human truth: reporting what is, not what is comfortable. |
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| A.8.24 | Use of cryptography | direct | Hashes and checksums are how a record proves it has not been altered. |
| A.6.8 | Information security event reporting | direct | Event reporting is the channel that lets an uncomfortable truth travel up rather than be buried. |
| A.8.15 | Logging | direct | Logging preserves a truthful account of what happened for later scrutiny. |