The Regulator's New Question: How Did You Get That Number?

Last quarter, a regulator walked into a client engagement and asked a question that simply did not exist five years ago. The question was not whether the number on the dashboard was accurate. The question was how the number got there. What system produced the raw signal. What formula transformed it. What version of that formula was in effect on the day of measurement. Who approved the change when the denominator shifted last March. The client had the number. The client did not have the chain. And in the silence that followed, a new vocabulary word entered the room: provenance.

Metric provenance is the traceable path from raw source data to the reported value, including the formula version in force at the time of calculation and the timestamp at which the underlying data was collected. It is the difference between asserting that mean time to detect is 14 hours and being able to demonstrate, in a defensible artifact, which sensors contributed, which incidents were included, which were excluded, and under which definition of “detection” the clock started. One is a number on a slide. The other is evidence.

A Regulatory Convergence

The shift is not theoretical and it is not isolated. SAMA’s cyber resilience framework, CBUAE’s expanding supervisory expectations, and the SEC’s cybersecurity disclosure rules are converging on the same posture from three different regulatory traditions. The implicit message is consistent: a reported metric is now treated as a regulated statement, and a regulated statement must carry the receipts that allow an examiner to reconstruct it. The old standard — “show us the number” — assumed the institution behind the number was trustworthy by default. The new standard — “show us how you got the number” — assumes nothing and asks for the chain.

The Quiet Mutation Problem

The operational consequences are larger than they appear. Most security organizations report metrics that have quietly mutated over the year. A definition was tightened. A data source was swapped. An exclusion was added to filter out a noisy business unit. None of these changes are improper on their own. They become liabilities only when there is no record of when they happened, who approved them, and which board reports were generated under which version. Without provenance, last quarter’s improvement might be a genuine reduction in risk or it might be a definitional artifact, and the institution cannot tell the difference from its own evidence. Neither can the auditor. That ambiguity used to be tolerated. In 2026 it is becoming the finding.

A Board Communication Standard

There is a quieter benefit to provenance that gets less attention than the regulatory one. Boards have become more sophisticated readers of security metrics, and the questions they ask have grown sharper. When a director asks why phishing click rates dropped, the CISO who can answer “because we changed the simulation difficulty in April and here is the version log” earns a different kind of credibility than the one who answers “because awareness is improving.” The first answer is auditable. The second is a hope. Provenance is not just an audit defense, it is a board communication standard.

Building the Chain

The institutions that will move fastest are the ones already treating metric provenance as a first-class data product rather than a reporting afterthought. That means versioned formulas, immutable collection timestamps, source-to-report lineage, and change-control on the metric definitions themselves — the same discipline that financial reporting has applied to general ledger entries for decades, now applied to the security telemetry that boards and regulators are increasingly treating as material.

We built Metric Maestro because the gap between “we have the number” and “we can defend the number” is widening, and the institutions on the wrong side of it are running out of time to catch up. If your next audit prep conversation is on the calendar, the word your team should walk in already using is provenance. Reach out and we will share the one-page checklist we use with clients to pressure-test the chain before a regulator does it for them.