Review a Linux boundary as a whole

A perfect score can answer a narrower question than the one you intended.

Read the denominator

A hardening baseline describes intended configuration. A scan measures selected settings against that baseline, at a particular time and within a stated scope. Passing those checks is useful evidence, but it does not establish that every identity still needs its access.

Connect configuration review with account purpose, effective permissions, service dependencies, and recovery. An exception needs a reason, accountable owner, and review point; a permanent unexplained exception quietly becomes the real policy.

Supplied record: a small museum

The fictional museum provides three current records:

Scan: 100 of 100 configuration checks passed for patch settings, remote-login settings, and logging.
Scope note: account ownership and business purpose excluded.
Account register: archive-export active, able to read collection records; its project ended last month.

Assume the scan and account data are accurate. The register has no current purpose approval, but the dependency review has not been completed. That is an access-lifecycle gap, not evidence that every scan result is wrong or that the account has been misused.

Write an actionable finding

Ask the collection owner to decide whether any approved export still depends on the account. Assign an operator to implement the resulting access decision with a scheduled review date.

Your closure criteria should require an approved purpose with appropriate access, or retirement confirmed across the relevant identity and service records. Preserve a needed export through an approved replacement when necessary. Attach evidence of that outcome instead of increasing the score manually.