Security vendor evidence completeness calculator

Calculate current externally verified evidence coverage by vendor with your own figures.

Your numbers

Use the units shown. Results update as you change valid inputs.

Use current externally verified evidence coverage by vendor to compare changes to your inputs. The method and limits below explain the scope.

Examples

Examples

Try the starting example

Vendor IDs joined by |
A|B
Required control IDs joined by |
C1|C2
Supplied evidence: evidence ID, vendor, control, expiry inclusive, externally verified yes/no; or none
E1,A,C1,2026-10-31,yes E2,A,C2,2026-10-01,yes E3,B,C1,2026-10-31,no
Audit date
2026-10-20
Current externally verified evidence coverage by vendor (%)
A: 50; B: 0
Outstanding control cells with missing/stale/unverified status
A/C2: stale, B/C1: unverified, B/C2: missing
Expired supplied evidence IDs
E2
Supplied evidence IDs not externally verified
E3
Current verified coverage across required vendor/control matrix (%)
25

Try another scenario

Vendor IDs joined by |
A|B
Required control IDs joined by |
C1|C2
Supplied evidence: evidence ID, vendor, control, expiry inclusive, externally verified yes/no; or none
E1,A,C1,2026-10-31,yes E2,A,C2,2026-10-31,yes E3,B,C1,2026-10-31,no
Audit date
2026-10-20
Current externally verified evidence coverage by vendor (%)
A: 100; B: 0
Outstanding control cells with missing/stale/unverified status
B/C1: unverified, B/C2: missing
Expired supplied evidence IDs
None
Supplied evidence IDs not externally verified
E3
Current verified coverage across required vendor/control matrix (%)
50
Calculation method

Calculation method

Current externally verified evidence coverage by vendor (%)

For each required control count current evidence only when some supplied record has verified=yes and expiry≥audit.

Outstanding control cells with missing/stale/unverified status

Missing=no record; stale=all records expired; otherwise unverified when no current verified record exists.

Expired supplied evidence IDs

All evidence records with expiry<audit, including superseded records.

Supplied evidence IDs not externally verified

All evidence records whose supplied verified flag is no, regardless of expiry.

Current verified coverage across required vendor/control matrix (%)

Current verified matrix cells/(vendors×required controls)×100.

Symbols and units
a
Vendor IDs joined by |
b
Required control IDs joined by |
c
Supplied evidence: evidence ID, vendor, control, expiry inclusive, externally verified yes/no; or none
d
Audit date

Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.

Assumptions & limits

Assumptions & limits

  • A supplied evidence-inventory completeness audit. The externally verified flag is an input, not verification performed here; document coverage does not establish control effectiveness, compliance or vendor safety.
Are these inputs private?

These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.

Further reading

NIST SP 800-53: background for inventory, access, audit and contingency controls; worksheet algorithms and rules are explicitly supplied, not NIST compliance tests ↗

Background reading; this does not imply endorsement or independent review of SumFizz.

Share this page
Share this calculator

Leave unchecked to share the page without your entered values.