Digital trust is what enables us to build, participate in and grow the connected world that we now live in. It allows us all to have confidence that the things we are doing online — whether interactions, transactions or business processes — are secure.

In Digital Trust as an IT Imperative, we talked about the four building blocks of digital trust:

• Industry and technology standards that define what constitutes trust
• Compliance and operations that govern delivery of trust, with a foundation in PKI
• Software that provides management of public/and or private trust within an organization, with centralized visibility and control over digital certificate lifecycles
• Extension of trust through ecosystems, such as across device lifecycles, software supply chains, consortiums and more

But what constitutes digital trust success? And how do you measure it?

Within IT departments, there can be multiple stewards of digital trust, among them:  PKI administrators, identity and access managers, and information/product security architects. Each of these IT departments has metrics that measures success — or a path to success — of digital trust initiatives. And some of these metrics make it to the boardroom, underscoring the importance of digital trust to business objectives.

These metrics may fall in four core areas:

1. Outages

What is being measured: Outages caused by unintended certificate expiration are highly visible, particularly if they occur in mission-critical systems. Outages can have multiple causes. They can occur due to oversight, particularly if certificates are tracked manually. They can be caused by human error, due to incorrectly configured certificates. Or they can be caused by rogue activity, that is, ungoverned certificates purchased outside of the purview of IT management.

Metrics can include:

• the number of outages due to unintended certificate expiry (for many, this target number is zero), 
  
• the financial impact of the outage, and/or
• time to resolution if such an outage occurs.
  

Who is measuring it: Outages affect multiple groups, but are meaningful to IT operations, site reliability engineering, and application engineering.

How to address: Methods to reduce the number of or potential for outages can include centralizing certificate management and automating certificate renewal.

2. Adoption/usability/security

What is being measured: Adoption is also a key metric. Are users installing certificates where they are needed? Are they calling tech support for configuration help? Are certificate issues keeping employees from being productive on onboarding or creating security gaps between employee departure and system access revocation?

Metrics can include:

• Adoption rate
  
• Tech support load
  
• Time to provision/revoke
  

Who is measuring it: These kinds of considerations are important to identity and access managers responsible for system access and provisioning of services such as VPN, wireless or email security. They may also be important metrics for centralized IT operations serving the needs of IT departments in other business units or subsidiaries.

How to address: IT professionals view automation as a key strategy for addressing adoption, usability and security concerns. Automation can make credential provisioning and management invisible to the end-user and seamless with onboarding and offboarding, improving adoption rates, reducing tech support load and eliminating provisioning gaps.