Coverage rate (required fields present), freshness (days since review), retrieval time, incident resolution impact, stale credential count.

Run a quarterly sample audit by client; remediate gaps; update baseline requirements based on incident learnings.