Measuring CMDB accuracy with numbers you can defend

Why measure at all?

"The CMDB is wrong" is an opinion that stops investment. "Twelve percent of laptops in the EDR console are missing from the CMDB" is a fact that starts a fix. Measures also show whether an alternative you are piloting is working.

Measure 1: coverage

Take a list from a source you trust for one asset class, such as the EDR console for laptops or the cloud provider for instances, and count how many of its assets exist in the CMDB. Repeat for each class. Coverage gaps point to missing sources.

Measure 2: sampled correctness

Pick fifty records at random each month. Check five fields on each against the systems you named as sources of truth in lesson 5. Report the share of fields that were right. Fifty is small enough to do by hand and large enough to show a trend.

Measure 3: duplicates and ghosts

Count records that describe the same asset twice, and records for assets that no source has reported for, say, sixty days. Both should fall month on month once matching and retirement work.

Measure 4: owner coverage

The share of records with a current owner. Check "current" by comparing against the HR or identity directory: an owner who has left is not an owner.

Measure 5: record age

For each record, the time since a source last confirmed it. A median that grows means discovery or a connector has stopped.

How do standards frame this?

NIST's Cybersecurity Framework places asset management in its Identify function, and NIST published a quick-start guide on CSF 2.0 informative references (SP 1347) on 25 August 2026, which explains how other standards map to CSF outcomes. For operational technology, NIST's draft SP 800-82 Revision 4, released on 21 September 2026 with comments open until 30 November 2026, expands guidance on asset management and network monitoring. These frameworks ask for an accurate inventory; the measures above are how you show you have one.

How often should you measure?

Monthly is enough for most organizations. Coverage and record age can be computed automatically every week; sampled correctness takes an hour of someone's time and is best done by the same person each month, so the method stays consistent. Keep the history: a trend over six months says more than any single figure.

Where should the numbers go?

On one page the service desk, security and infrastructure teams all see. Accuracy improves fastest when the teams who suffer from a wrong record can see it getting better or worse.