05 / 08 of 8
Sincerity
pronounced mah-koh-toh
Report what is, not what is comfortable.
Make the system tell the truth.
Security decisions depend on the accuracy of the information behind them.
An inventory must represent the assets that actually exist. Logs must represent what actually happened. Configuration records must represent the deployed state. Integrity controls must detect unauthorised changes.
A dashboard showing 100% compliance is useless if the underlying inventory is incomplete.
A security control cannot compensate for false information upstream.
“Verify the state you are defending.”
What a practitioner who holds this virtue does.
Verify reality.
Domain: Data integrity and truthful reporting
Sincerity is making the system tell the truth. Every security decision rests on the accuracy of the inventory, the logs, and the configuration records behind it.
Make the behaviour explicit and repeatable.
Define authoritative sources
Identify which system is authoritative for assets, identities, vulnerabilities, configurations and other security data.
Discipline: MetsukePerceive
Define data ownership
Assign owners to important security datasets.
Discipline: MetsukePerceive
Record freshness
Make the age of security data visible.
Discipline: ZanshinRemain aware
Distinguish unknown from compliant
Do not treat missing telemetry as a passing result.
Discipline: KatanaAnalyse
Document measurement limits
State what each security metric includes and excludes.
Discipline: KatanaAnalyse
Embed the behaviour into processes and ownership.
Reconcile inventories
Compare CMDB, cloud inventories, endpoint platforms, vulnerability scanners and network discovery.
Discipline: MetsukePerceive
Monitor security telemetry
Detect when log sources, agents, scanners or integrations stop reporting.
Discipline: ZanshinRemain aware
Validate critical metrics
Check the underlying data behind important dashboards.
Discipline: KatanaAnalyse
Protect security records
Restrict modification and deletion of logs, evidence and audit records.
Discipline: KatanaAnalyse
Establish data-quality workflows
Assign discrepancies to owners and track them to resolution.
Discipline: ZanshinRemain aware
Verify that the behaviour is happening and that it works.
Measure inventory coverage
Track the percentage of assets represented across required security systems.
Discipline: MetsukePerceive
Measure telemetry coverage
Track which critical systems are actually producing the expected logs.
Discipline: MetsukePerceive
Measure data freshness
Identify security data that has become too old to support decisions.
Discipline: ZanshinRemain aware
Sample compliance claims
Test whether reported compliance matches actual configuration.
Discipline: KatanaAnalyse
Track reconciliation gaps
Measure recurring differences between authoritative and operational datasets.
Discipline: ZanshinRemain aware
Use evidence to improve the behaviour and respond to change.
Automate reconciliation
Continuously compare inventories and security platforms.
Discipline: ZanshinRemain aware
Detect silent failure
Alert when a security control stops producing expected evidence.
Discipline: ZanshinRemain aware
Propagate data quality
Prevent incomplete or stale source data from being presented as authoritative downstream.
Discipline: TateProtect
Link metrics to evidence
Allow important security claims to be traced back to the underlying records.
Discipline: KatanaAnalyse
Make uncertainty operational
Use confidence and coverage information when prioritising security decisions.
Discipline: MetsukePerceive
The CMDB reports 12,000 servers.
The vulnerability platform sees 14,700 assets.
The security team does not claim 100% scanning coverage.
They reconcile the inventories and identify the missing systems.
You cannot measure security coverage against an inventory you do not trust.
The SIEM shows no authentication failures for a critical application.
The team assumes the application is healthy.
During an investigation they discover that the application stopped forwarding logs three weeks earlier.
The absence of evidence was mistaken for evidence of absence.
A silent sensor is not a clean system.
A dashboard shows 95% of critical vulnerabilities remediated.
The underlying tickets show that several vulnerabilities were marked "accepted" rather than fixed.
The metric is redesigned to distinguish remediation from risk acceptance.
Do not let the dashboard hide the difference between fixing risk and recording risk.
Servers report compliant CIS configurations.
A spot check finds that the compliance agent is not running on several production servers.
The organisation changes the control to distinguish "compliant" from "not reporting."
A missing measurement must not become a passing measurement.
During an incident, several teams provide different timestamps for the same event.
The incident commander reconstructs the timeline from authoritative logs rather than relying on recollection.
The actual initial compromise is identified six hours earlier than originally believed.
When the facts matter, verify them against evidence.
Reading: Makoto has two halves — machine truth (hashes, checksums) and human truth (reporting the breach you would rather not) — and both belong here.
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| PR.DS-01 | Confidentiality, integrity, and availability of data at rest | direct | Integrity checks on data at rest are machine truth — the system reporting its own state honestly. |
| RS.CO-02 | Incidents reported to internal and external stakeholders | direct | Notifying stakeholders of an incident is human truth: reporting what is, not what is comfortable. |
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| A.8.24 | Use of cryptography | direct | Hashes and checksums are how a record proves it has not been altered. |
| A.6.8 | Information security event reporting | direct | Event reporting is the channel that lets an uncomfortable truth travel up rather than be buried. |
| A.8.15 | Logging | direct | Logging preserves a truthful account of what happened for later scrutiny. |
A dashboard tuned until it shows green.
When Makoto is absent, dashboards become fiction. Asset counts are wrong. "No alerts" means "no telemetry." Compliance percentages hide missing data.
