Sector · Government

A classified document does not stop being classified because the technology changed.

The public sector holds information whose classification term is measured in decades and whose technology replacement depends on procurement cycles that are equally long. Both ends push the same way: the data stays sensitive for a long time, and the ability to replace its protection arrives slowly.

Sector median · Government98.1Critical

7,203companies

94.3–100.0Half of the cohort between p25 and p75

The comparison available

The vast majority of the government cohort falls into the two highest bands on the ruler, and the sector median is the highest among the five sectors with a page of their own.

Dispersion, however, is wide: there is meaningful distance between the best and worst positioned organizations, which means position is not destiny: part of it responds to configuration and vendor decisions.The aggregates describe the cohort on the date the ruler was generated, with an anonymity floor. No agency is identifiable in them.

Cohort distribution by band

Critical87.8%
High0.6%
Moderate0.1%
Minimal11.6%

Data shelf life

This sector shares the highest median confidentiality horizon on the ruler with healthcare and defense: what it protects must stay secret for terms few sectors face.

When the secrecy term outlasts the technology guaranteeing it, the difference becomes accumulated exposure.

Data the sector keeps for a long time

Classified information with a legal secrecy term.
Citizen data that follows a person for life.
Diplomatic and security communication.
Critical infrastructure and planning records.

What distinguishes the sector

Government combines one of the longest secrecy terms on the ruler with the least replacement flexibility: formal procurement, multi-year contracts, approved vendor lists, and infrastructure serving essential services that cannot stop.

The sector's HNDL context. When the secrecy term is measured in decades, the question stops being whether break capability will exist within it and becomes what has already been captured. This sector is where the structure of HNDL risk shows most clearly: long-lived data, slow replacement, and a wide public surface, because public services must be reachable.

Classification terms defined in law.
Procurement by formal process, on its own cycle.
Approved vendors and slow substitution.
Essential services with low tolerance for interruption.

Typical dependencies

Approved infrastructure and software vendors.
Hosting and connectivity providers for digital services.
Certification chains used on service portals.
Integrations across agencies and levels of government.

What applies

In a sector with formal procurement, a readout must be documentable and citable before it is useful.

01Exposure ReportA readout from public signals, with no access to the environment.In production

02Published methodologyA documented criterion under an open license, with a citable DOI.In production

03ApplianceExecution inside the perimeter, when data cannot travel. Internal use, licensed by contract.Internal use

See a sample report →

See the limits of this reading and what it is measured against

The limits of this readout

IEQ does not attest compliance with any standard, normative instruction, or certification requirement.
Collection observes only the public surface; systems on restricted networks are not in the readout.
The absence of a public post-quantum readiness signal does not prove the absence of an internal initiative.
Time scenarios are scenarios, not predictions of the cryptographic break date.

Boundary

Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.

Why measuring does not reduce exposure

What this comparison is measured against

Ruler generated: October 7, 2026
Population: 80,182 companies
Sectors: 15 sectors in the engine taxonomy
Anonymity floor: K = 30

Limits of the comparison

The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
Comparison is always against anonymous aggregates, never against another organization's individual result.
A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

Start from the method

The methodology is published under an open license and can be reviewed before any commercial conversation, including by whoever must justify the choice of criterion.

Discuss an assessment See a sample report →