A source of truth is the system designated as authoritative for a particular kind of data. When two systems disagree, the designated one wins.
The phrase gets used as though an organization should have one. It should have several, one per domain, and the useful work is deciding which is authoritative for what.
Asset existence and ownership usually belongs to the CMDB or asset inventory, even when it is known to be incomplete, because the alternative is having no reference point.
Asset state, such as agent version or patch level, usually belongs to the tool that manages it rather than to the inventory, which will be stale.
Identity and employment status belongs to the HR system, not the directory. The directory is downstream and lags.
Finding severity belongs to the scanner that raised it, with any risk-weighted adjustment applied as a separate, recorded step.
Financial commitment belongs to the ERP, not to a security team spreadsheet.
They will not go away, and their pattern is diagnostic.
The EDR knows about 12,400 endpoints. The CMDB lists 11,900. Neither is wrong, exactly. The EDR sees devices that were never registered. The CMDB holds devices that were decommissioned without being removed.
The disagreement is itself a finding. A persistent gap between an inventory and a tool that discovers is a measure of how well asset onboarding works, and it is often more useful than either figure alone.
Designate authority per field, not per system. One system can be authoritative for existence and another for state.
Record the source that provided each value, so a disputed number can be traced to the system that supplied it rather than argued about in the abstract.
Measure the disagreements and treat the trend as a metric in its own right.
Never resolve a conflict by silently preferring one source. Record which was used and why, or the resolution becomes an invisible assumption embedded in every metric downstream.
From the blog