The coverage rate of a security measure determines its contribution to the compliance score of a requirement. If this rate does not match your needs, you can modify it directly in the solution.
⚠️ This modification is only possible if the policy is private. The coverage rate of requirements in a public policy cannot be modified.
Modifying the coverage rate of a requirement
Click on the relevant policy in the Policies module, then on "Edit policy."
Click on the requirement whose coverage rate you wish to modify.
In the list of measures associated with the requirement, click on the coverage field of the relevant measure and enter the desired percentage (between 0 and 100), or click "Balance" to distribute the coverage equally among the measures.
Check that the sum of the coverage rates of the associated measures matches the compliance target you wish to achieve for this requirement.
The sum of the coverage rates of the measures associated with a requirement can be: = 100% (exact coverage), > 100% (redundancy, at your discretion), or < 100% (partial coverage: all associated measures must be deployed to achieve compliance on this requirement).
⚠️ Modifying the coverage rate from the Catalog updates the template of your policy: the modification does not automatically apply to perimeters where measures are already being implemented or are beneficiaries. To make it effective on these perimeters, you must dissociate and then reassociate the relevant perimeters with the policy.
Frequently asked questions
Can I modify the coverage rate of a public policy? No. Only private policies allow you to modify the coverage rate of measures associated with a requirement.
What happens if the sum of the coverage rates of a requirement exceeds 100%? This means there is redundancy among the associated measures: several measures cover the same requirement beyond what is necessary. This is a choice that is yours to make — it does not cause any error or blocking.
If the sum of the coverage rates is less than 100%, am I non-compliant on this requirement? All measures associated with the requirement must be deployed to reach 100% coverage and therefore full compliance on this requirement. A sum below 100% indicates partial coverage.
I modified the coverage rate, but my already compliant perimeters are not showing the change — why? The modification made from the Catalog updates the policy template, not the perimeters that are already using it. You must dissociate and then reassociate these perimeters with the policy for the new rate to apply to their measures that are being implemented or are beneficiaries.