A different question
The health signals say how well a team's practice is working. Urgency says how soon the team needs attention. It is designed to tell the auditor where to look first, and it makes no judgment about quality.
It also runs in the opposite direction. For a health signal, higher is better. For urgency, higher means a greater need to intervene.
How urgency is built
- Start from health. The weaker a resource's process and posture signals, the higher its base urgency.
- Adjust for significance. A resource whose compromise would do more harm raises urgency, and a low-impact resource lowers it. A resource that has never been classified is treated as high, because unknown exposure is a risk in itself.
- Adjust for recency. Recent activity lowers urgency. A resource that nobody has updated for a long time raises it.
The adjustments scale what is already there. A resource in good health stays near the bottom of the list, however significant it is.
Surprises are informative
A team can rank as urgent when its health is mediocre and not poor. A highly significant resource with a moderately low score and no recent activity can outrank a team with worse scores, lower-impact resources and recent work.
When a ranking is surprising, check significance and recency before assuming that health is the cause.
Ranking teams
Teams are ranked on a blend of three things:
- Severity. The team's urgency compared with the other teams in view.
- Exposure. The residual risk recorded for the team's resources.
- Magnitude. How much significant resource the team owns, whatever its state of mitigation.
Ranks are relative to the group being viewed, so they change when the view is filtered. That is intended. The ranking answers the question of who needs attention most within whatever scope the auditor is examining.
Teams with nothing to measure
A team with no resources recorded cannot be ranked, and it belongs on a watchlist. It probably needs help getting started.
A new team begins with low urgency, which rises the longer it stays unmeasured. An unmeasured team becomes a greater concern over time.
The same logic as the two scores
Urgency applies the reasoning behind the methodology's two original scores: low coverage combined with high risk comes first. Two Scores: Coverage Maturity and Administrative Risk sets that out.