diff --git a/inventory/inventory-fwupd/README.org b/inventory/inventory-fwupd/README.org
index ac5c80d..0319946 100644
--- a/inventory/inventory-fwupd/README.org
+++ b/inventory/inventory-fwupd/README.org
@@ -46,30 +46,31 @@ For every device fwupd reports (keyed by DeviceId):
 | Attribute                       | Format                                                     |
 |---------------------------------+------------------------------------------------------------|
 | *Firmware HSI level*            | =HSI:0= through =HSI:4=                                   |
-| *Firmware HSI L<n>: <Name>*     | =PASS= or =FAIL= (one per security check)                 |
-| *Firmware HSI attributes*       | =Name (HSI L<level>): <result> [PASS|FAIL]= (slist)       |
+| *Firmware HSI failing*          | =L<n>: <Name>= (slist)                                    |
+| *Firmware HSI passing*          | =L<n>: <Name>= (slist)                                    |
 
 *Firmware HSI level* is the rolled-up Host Security Identifier level.
 fwupd walks levels 1--4 sequentially; the result is the highest level
 where all attributes pass, stopping at the first level with any failure.
 
-*Firmware HSI L<n>: <Name>* variables (e.g. =Firmware HSI L1: TPM v2.0=)
-are individual string attributes with value =PASS= or =FAIL=. These are
-consumed by *compliance-report-fwupd* for per-check compliance conditions.
-Two normalizations are applied to keep inventory attribute names stable
-and aligned with the HSI specification:
+*Firmware HSI failing* and *Firmware HSI passing* are slists of the
+security checks fwupd reported, split by outcome (e.g. =L1: TPM v2.0=).
+The check set is hardware dependent, so a check in neither list is not
+applicable to this host. *compliance-report-fwupd* matches an exact item
+against *Firmware HSI failing* for its per-check conditions.
+
+Items keep the =L<n>:= prefix because the name alone is not unique:
+fwupd reports two distinct checks named =Platform debugging=, at L1
+(Intel DCI) and L2 (debug locked). Two normalizations keep items stable:
 
 - *Name normalization:* The CSME version attribute is emitted as
-  =Firmware HSI L1: CSME version= regardless of the firmware version
-  string fwupd reports (which varies per host).
+  =L1: CSME version= regardless of the firmware version string fwupd
+  reports (which varies per host).
 - *Level normalization:* fwupd marks some runtime checks at HsiLevel 0
   even though they contribute to scored HSI levels. The module maps
   these to their specification levels: =UEFI secure boot= is emitted
   at L1 (not L0) and =CET OS Support= at L3 (not L0).
 
-*Firmware HSI attributes* is an slist with one detailed entry per
-security check, useful for drill-down in Mission Portal inventory views.
-
 * Measurements
 
 The following values are emitted as =cf-monitord= measurements for
diff --git a/inventory/inventory-fwupd/mp-inventory-fwupd-columns.png b/inventory/inventory-fwupd/mp-inventory-fwupd-columns.png
index 194d80c..a330441 100644
Binary files a/inventory/inventory-fwupd/mp-inventory-fwupd-columns.png and b/inventory/inventory-fwupd/mp-inventory-fwupd-columns.png differ
diff --git a/inventory/inventory-fwupd/policy.cf b/inventory/inventory-fwupd/policy.cf
index 042ea94..0bcdb8d 100644
--- a/inventory/inventory-fwupd/policy.cf
+++ b/inventory/inventory-fwupd/policy.cf
@@ -383,10 +383,8 @@ bundle agent inventory_fwupd_hsi(security_src)
 #   compute the rolled-up HSI level.
 #
 # Emits:
-#  - Per-attribute PASS/FAIL strings named "Firmware HSI L<n>: <Name>"
-#    for use in compliance report conditions.
-#  - An slist of detailed results formatted "Name (HSI L<level>):
-#    <result> [PASS|FAIL]" for inventory drill-down.
+#  - "Firmware HSI failing" and "Firmware HSI passing", slists of
+#    "L<level>: <name>" check names split by outcome.
 #  - A count of failing attributes.
 #  - The rolled-up HSI level (e.g. "HSI:3").
 #
@@ -419,6 +417,13 @@ bundle agent inventory_fwupd_hsi(security_src)
     "_level[$(_idxes)]"
       string => "$(_sec[SecurityAttributes][$(_idxes)][HsiLevel])";
 
+    # fwupd omits HsiLevel on runtime-issue checks (Linux kernel, UEFI db,
+    # ...). Default those to L0, otherwise the unresolved level skips
+    # every promise that builds on it and the check vanishes entirely.
+    "_level[$(_idxes)]"
+      string => "0",
+      unless => isvariable("_level[$(_idxes)]");
+
     "_result[$(_idxes)]"
       string => "$(_sec[SecurityAttributes][$(_idxes)][HsiResult])";
 
@@ -444,10 +449,9 @@ bundle agent inventory_fwupd_hsi(security_src)
         "$(_name[$(_idxes)])"
       );
 
-    # Normalized level for per-attribute inventory: fwupd marks some
-    # attributes as HsiLevel 0 with a "runtime-issue" flag even though
-    # they contribute to scored HSI levels. Map them to their HSI spec
-    # level so inventory attribute names match compliance conditions.
+    # Normalized level: fwupd marks some attributes as HsiLevel 0 with a
+    # "runtime-issue" flag even though they contribute to scored HSI
+    # levels. Map them to their HSI spec level so list items are stable.
     #   UEFI secure boot  (org.fwupd.hsi.Uefi.SecureBoot) → HSI:1
     #   CET OS Support    (org.fwupd.hsi.IntelCet.Active)  → HSI:3
     "_inv_level[$(_idxes)]"
@@ -459,19 +463,35 @@ bundle agent inventory_fwupd_hsi(security_src)
         "$(_level[$(_idxes)])"
       );
 
-    # Per-attribute inventory: one string variable per HSI check,
-    # named "Firmware HSI L<level>: <name>" with value PASS or FAIL.
-    # This enables per-check compliance report conditions.
-    "fwupd_hsi_check[$(_idxes)]"
-      string => "$(_status[$(_idxes)])",
-      meta => {
-        "inventory",
-        "attribute_name=Firmware HSI L$(_inv_level[$(_idxes)]): $(_inv_name[$(_idxes)])",
-      };
-
-    "fwupd_hsi_attr[$(_idxes)]"
-      string => "$(_name[$(_idxes)]) (HSI L$(_level[$(_idxes)])): $(_result[$(_idxes)]) [$(_status[$(_idxes)])]",
-      meta => { "inventory", "attribute_name=Firmware HSI attributes" };
+    # Check names split by outcome into two lists, rather than one
+    # inventory attribute per check.
+    #
+    # Inventory attribute names are fleet wide: an attribute any host
+    # defines is offered as a column for every host. fwupd's check set
+    # is hardware dependent, so one attribute per check grew that list
+    # with every distinct chipset in the fleet while each host filled in
+    # only its own subset. Two lists keep this module at two stable
+    # attribute names regardless of the hardware, and carry the same
+    # information: a check in neither list is not applicable to this
+    # host.
+    #
+    # The level prefix disambiguates fwupd's two distinct checks both
+    # named "Platform debugging" (L1 Intel DCI, L2 debug locked).
+    "_failing_name[$(_idxes)]"
+      string => "L$(_inv_level[$(_idxes)]): $(_inv_name[$(_idxes)])",
+      if => strcmp("$(_status[$(_idxes)])", "FAIL");
+
+    "_passing_name[$(_idxes)]"
+      string => "L$(_inv_level[$(_idxes)]): $(_inv_name[$(_idxes)])",
+      if => strcmp("$(_status[$(_idxes)])", "PASS");
+
+    "fwupd_hsi_failing"
+      slist => getvalues("_failing_name"),
+      meta => { "inventory", "attribute_name=Firmware HSI failing" };
+
+    "fwupd_hsi_passing"
+      slist => getvalues("_passing_name"),
+      meta => { "inventory", "attribute_name=Firmware HSI passing" };
 
     "fwupd_hsi_failing_count"
       int => countclassesmatching("inventory_fwupd_hsi_failing_[0-9]+");
diff --git a/management/manage-fwupd/README.org b/management/manage-fwupd/README.org
index 009fd20..8436cfe 100644
--- a/management/manage-fwupd/README.org
+++ b/management/manage-fwupd/README.org
@@ -93,9 +93,7 @@ first.
 * Mission Portal
 
 The module reports =fwupd management status= as an inventory attribute
-visible in Mission Portal's inventory reports:
-
-[[https://raw.githubusercontent.com/cfengine/modules/master/management/manage-fwupd/mp-inventory-fwupd-status.png]]
+visible in Mission Portal's inventory reports.
 
 * Behavior
 
diff --git a/management/manage-fwupd/mp-inventory-fwupd-status.png b/management/manage-fwupd/mp-inventory-fwupd-status.png
deleted file mode 100644
index e2f702d..0000000
Binary files a/management/manage-fwupd/mp-inventory-fwupd-status.png and /dev/null differ
diff --git a/reporting/compliance-report-fwupd/README.org b/reporting/compliance-report-fwupd/README.org
index 3b1eb1f..726872c 100644
--- a/reporting/compliance-report-fwupd/README.org
+++ b/reporting/compliance-report-fwupd/README.org
@@ -22,15 +22,15 @@ checks covering every individual HSI firmware security test.
 
 * Rolled-up Conditions
 
-| Condition                         | Category           | Severity |
-|-----------------------------------+--------------------+----------|
-| *fwupd installed*                 | Firmware tooling   | high     |
-| *HSI Level 1+ (Critical)*        | HSI Level Overview | high     |
-| *HSI Level 2+ (Important)*       | HSI Level Overview | medium   |
-| *HSI Level 3+ (Recommended)*     | HSI Level Overview | low      |
-| *HSI Level 4 (Complete)*         | HSI Level Overview | low      |
-| *No pending firmware updates*    | Firmware updates   | medium   |
-| *Firmware status healthy*        | Firmware updates   | medium   |
+| Condition                     | Category           | Severity |
+|-------------------------------+--------------------+----------|
+| *fwupd installed*             | Firmware tooling   | high     |
+| *HSI Level 1+ (Critical)*     | HSI Level Overview | high     |
+| *HSI Level 2+ (Important)*    | HSI Level Overview | medium   |
+| *HSI Level 3+ (Recommended)*  | HSI Level Overview | low      |
+| *HSI Level 4 (Complete)*      | HSI Level Overview | low      |
+| *No pending firmware updates* | Firmware updates   | medium   |
+| *Firmware status healthy*     | Firmware updates   | medium   |
 
 HSI level checks are cumulative thresholds -- a host at HSI:3 passes
 the Level 1+, 2+, and 3+ conditions but fails Level 4.
@@ -38,100 +38,101 @@ the Level 1+, 2+, and 3+ conditions but fails Level 4.
 * Per-Attribute Conditions
 
 Each individual HSI firmware security check is a separate compliance
-condition. The inventory attribute name follows the pattern
-=Firmware HSI L<level>: <Name>= with value =PASS= or =FAIL=.
+condition. Every one matches an exact item against the
+*Firmware HSI failing* slist from *inventory-fwupd*, whose items follow
+the pattern =L<level>: <Name>=.
 
 Per-attribute conditions use ~condition_for: "failing"~ -- a host is
-only marked failing when the attribute is explicitly =FAIL=. Hosts
-that don't report a given attribute (e.g., Intel-only checks on AMD
-hardware, or VMs without HSI data) show as "not evaluated" rather
-than failing. The checks are defined by the
+only marked failing when the check appears in that list. Hosts that
+don't report a given check (e.g., Intel-only checks on AMD hardware, or
+VMs without HSI data) show as "not evaluated" rather than failing,
+because the check appears in neither the failing nor the passing list. The checks are defined by the
 [[https://fwupd.github.io/libfwupdplugin/hsi.html][fwupd HSI specification]].
 
 ** Level 1 -- Critical (19 conditions, severity: high)
 
-| Condition                    | Inventory attribute                        | Platform |
-|------------------------------+--------------------------------------------+----------|
-| UEFI SecureBoot              | =Firmware HSI L1: UEFI secure boot=       | All      |
-| TPM 2.0 Present              | =Firmware HSI L1: TPM v2.0=               | All      |
-| Empty PCR in TPM             | =Firmware HSI L1: TPM empty PCRs=         | All      |
-| UEFI Platform Key            | =Firmware HSI L1: UEFI platform key=      | All      |
-| BIOS Capsule Updates         | =Firmware HSI L1: BIOS firmware updates=  | All      |
-| Supported CPU                | =Firmware HSI L1: Supported CPU=          | All      |
-| UEFI BootService Variables   | =Firmware HSI L1: UEFI bootservice variables= | All  |
-| BIOS Write Enable (BWE)      | =Firmware HSI L1: SPI write=              | Intel    |
-| BIOS Lock Enable (BLE)       | =Firmware HSI L1: SPI lock=               | Intel    |
-| SMM BIOS Write Protect       | =Firmware HSI L1: SPI BIOS region=        | Intel    |
-| Read-only SPI Descriptor     | =Firmware HSI L1: SPI descriptor=         | Intel    |
-| Platform Debug (Intel DCI)   | =Firmware HSI L1: Platform debugging=     | Intel    |
-| ME Manufacturing Mode        | =Firmware HSI L1: csme manufacturing mode= | Intel   |
-| ME Flash Descriptor Override | =Firmware HSI L1: csme override=          | Intel    |
-| ME BootGuard Platform Key    | =Firmware HSI L1: MEI key manifest=       | Intel    |
-| CSME Version                 | =Firmware HSI L1: CSME version=           | Intel    |
-| Part is Fused                | =Firmware HSI L1: Part is fused=          | Intel    |
-| AMD Microcode Signature      | =Firmware HSI L1: AMD microcode signature= | AMD     |
-| SMM Locked Down              | =Firmware HSI L1: SMM locked down=        | AMD      |
+| Condition                    | List item                        | Platform |
+|------------------------------+----------------------------------+----------|
+| UEFI SecureBoot              | =L1: UEFI secure boot=           | All      |
+| TPM 2.0 Present              | =L1: TPM v2.0=                   | All      |
+| Empty PCR in TPM             | =L1: TPM empty PCRs=             | All      |
+| UEFI Platform Key            | =L1: UEFI platform key=          | All      |
+| BIOS Capsule Updates         | =L1: BIOS firmware updates=      | All      |
+| Supported CPU                | =L1: Supported CPU=              | All      |
+| UEFI BootService Variables   | =L1: UEFI bootservice variables= | All      |
+| BIOS Write Enable (BWE)      | =L1: SPI write=                  | Intel    |
+| BIOS Lock Enable (BLE)       | =L1: SPI lock=                   | Intel    |
+| SMM BIOS Write Protect       | =L1: SPI BIOS region=            | Intel    |
+| Read-only SPI Descriptor     | =L1: SPI descriptor=             | Intel    |
+| Platform Debug (Intel DCI)   | =L1: Platform debugging=         | Intel    |
+| ME Manufacturing Mode        | =L1: csme manufacturing mode=    | Intel    |
+| ME Flash Descriptor Override | =L1: csme override=              | Intel    |
+| ME BootGuard Platform Key    | =L1: MEI key manifest=           | Intel    |
+| CSME Version                 | =L1: CSME version=               | Intel    |
+| Part is Fused                | =L1: Part is fused=              | Intel    |
+| AMD Microcode Signature      | =L1: AMD microcode signature=    | AMD      |
+| SMM Locked Down              | =L1: SMM locked down=            | AMD      |
 
 ** Level 2 -- Important (12 conditions, severity: medium)
 
-| Condition                  | Inventory attribute                             | Platform |
-|----------------------------+-------------------------------------------------+----------|
-| DMA Protection (IOMMU)     | =Firmware HSI L2: IOMMU=                        | All      |
-| PCR0 TPM Event Log         | =Firmware HSI L2: TPM PCR0 reconstruction=      | All      |
-| BIOS Rollback Protection   | =Firmware HSI L2: BIOS rollback protection=     | All      |
-| Intel BootGuard Enabled    | =Firmware HSI L2: Intel BootGuard=              | Intel    |
-| Intel BootGuard Verified   | =Firmware HSI L2: Intel BootGuard verified boot= | Intel   |
-| Intel BootGuard ACM        | =Firmware HSI L2: Intel BootGuard ACM protected= | Intel   |
-| Intel BootGuard OTP        | =Firmware HSI L2: Intel BootGuard OTP fuse=     | Intel    |
-| Part is Debug Locked       | =Firmware HSI L2: Platform debugging=           | Intel    |
-| Intel GDS Mitigation       | =Firmware HSI L2: Intel GDS mitigation=         | Intel    |
-| AMD Platform Secure Boot   | =Firmware HSI L2: AMD platform secure boot=     | AMD      |
-| AMD SPI Write Protections  | =Firmware HSI L2: AMD SPI write protections=    | AMD      |
-| HP SureStart               | =Firmware HSI L2: HP SureStart=                 | HP       |
+| Condition                 | List item                           | Platform |
+|---------------------------+-------------------------------------+----------|
+| DMA Protection (IOMMU)    | =L2: IOMMU=                         | All      |
+| PCR0 TPM Event Log        | =L2: TPM PCR0 reconstruction=       | All      |
+| BIOS Rollback Protection  | =L2: BIOS rollback protection=      | All      |
+| Intel BootGuard Enabled   | =L2: Intel BootGuard=               | Intel    |
+| Intel BootGuard Verified  | =L2: Intel BootGuard verified boot= | Intel    |
+| Intel BootGuard ACM       | =L2: Intel BootGuard ACM protected= | Intel    |
+| Intel BootGuard OTP       | =L2: Intel BootGuard OTP fuse=      | Intel    |
+| Part is Debug Locked      | =L2: Platform debugging=            | Intel    |
+| Intel GDS Mitigation      | =L2: Intel GDS mitigation=          | Intel    |
+| AMD Platform Secure Boot  | =L2: AMD platform secure boot=      | AMD      |
+| AMD SPI Write Protections | =L2: AMD SPI write protections=     | AMD      |
+| HP SureStart              | =L2: HP SureStart=                  | HP       |
 
 ** Level 3 -- Recommended (8 conditions, severity: low)
 
-| Condition                          | Inventory attribute                          | Platform |
-|------------------------------------+----------------------------------------------+----------|
-| Suspend-to-Idle                    | =Firmware HSI L3: Suspend-to-idle=           | All      |
-| Suspend to RAM Disabled            | =Firmware HSI L3: Suspend-to-ram=            | All      |
-| Pre-boot DMA Protection           | =Firmware HSI L3: Pre-boot DMA protection=  | All      |
-| CET Available                      | =Firmware HSI L3: CET Platform=             | All      |
-| CET Utilized by OS                | =Firmware HSI L3: CET OS Support=           | All      |
-| Early-boot UEFI Memory Protections | =Firmware HSI L3: UEFI memory protections=  | All      |
-| Intel BootGuard Policy             | =Firmware HSI L3: Intel BootGuard error policy= | Intel |
-| AMD SPI Replay Protections        | =Firmware HSI L3: AMD SPI replay protections= | AMD    |
+| Condition                          | List item                          | Platform |
+|------------------------------------+------------------------------------+----------|
+| Suspend-to-Idle                    | =L3: Suspend-to-idle=              | All      |
+| Suspend to RAM Disabled            | =L3: Suspend-to-ram=               | All      |
+| Pre-boot DMA Protection            | =L3: Pre-boot DMA protection=      | All      |
+| CET Available                      | =L3: CET Platform=                 | All      |
+| CET Utilized by OS                 | =L3: CET OS Support=               | All      |
+| Early-boot UEFI Memory Protections | =L3: UEFI memory protections=      | All      |
+| Intel BootGuard Policy             | =L3: Intel BootGuard error policy= | Intel    |
+| AMD SPI Replay Protections         | =L3: AMD SPI replay protections=   | AMD      |
 
 ** Level 4 -- Complete (3 conditions, severity: low)
 
-| Condition                     | Inventory attribute                        | Platform |
-|-------------------------------+--------------------------------------------+----------|
-| DRAM Memory Encryption        | =Firmware HSI L4: Encrypted RAM=           | All      |
-| SMAP                          | =Firmware HSI L4: SMAP=                    | All      |
-| AMD Secure Processor Rollback | =Firmware HSI L4: AMD rollback protection= | AMD      |
+| Condition                     | List item                     | Platform |
+|-------------------------------+-------------------------------+----------|
+| DRAM Memory Encryption        | =L4: Encrypted RAM=           | All      |
+| SMAP                          | =L4: SMAP=                    | All      |
+| AMD Secure Processor Rollback | =L4: AMD rollback protection= | AMD      |
 
 * Categories
 
 | Category                  | Conditions | Scope                      |
 |---------------------------+------------+----------------------------|
-| HSI Level Overview        |          4 | Rolled-up level thresholds |
-| HSI Level 1 - Critical    |         19 | Per-attribute checks       |
-| HSI Level 2 - Important   |         12 | Per-attribute checks       |
-| HSI Level 3 - Recommended |          8 | Per-attribute checks       |
-| HSI Level 4 - Complete    |          3 | Per-attribute checks       |
-| Firmware updates           |          2 | Update status              |
-| Firmware tooling           |          1 | fwupd installation         |
+| HSI Level Overview        | 4          | Rolled-up level thresholds |
+| HSI Level 1 - Critical    | 19         | Per-attribute checks       |
+| HSI Level 2 - Important   | 12         | Per-attribute checks       |
+| HSI Level 3 - Recommended | 8          | Per-attribute checks       |
+| HSI Level 4 - Complete    | 3          | Per-attribute checks       |
+| Firmware updates          | 2          | Update status              |
+| Firmware tooling          | 1          | fwupd installation         |
 
 * Platform support
 
 Linux only. Platform-specific conditions use =host_filter= class
 expressions so they only activate on relevant hardware:
 
-| Platform | =host_filter=              | Conditions | Detection                      |
-|----------+----------------------------+------------+--------------------------------|
-| All      | =linux=                    |         25 | --                             |
-| Intel    | =fwupd_cpu_vendor_intel=   |         17 | =/proc/cpuinfo= vendor_id      |
-| AMD      | =fwupd_cpu_vendor_amd=     |          6 | =/proc/cpuinfo= vendor_id      |
-| HP       | =fwupd_oem_vendor_hp=      |          1 | =/sys/class/dmi/id/sys_vendor= |
+| Platform | =host_filter=            | Conditions | Detection                      |
+|----------+--------------------------+------------+--------------------------------|
+| All      | =linux=                  | 25         | --                             |
+| Intel    | =fwupd_cpu_vendor_intel= | 17         | =/proc/cpuinfo= vendor_id      |
+| AMD      | =fwupd_cpu_vendor_amd=   | 6          | =/proc/cpuinfo= vendor_id      |
+| HP       | =fwupd_oem_vendor_hp=    | 1          | =/sys/class/dmi/id/sys_vendor= |
 
 These classes are defined by the *inventory-fwupd* module.
diff --git a/reporting/compliance-report-fwupd/fwupd-compliance-report.json b/reporting/compliance-report-fwupd/fwupd-compliance-report.json
index d4dd021..f2a8347 100644
--- a/reporting/compliance-report-fwupd/fwupd-compliance-report.json
+++ b/reporting/compliance-report-fwupd/fwupd-compliance-report.json
@@ -185,9 +185,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: UEFI secure boot",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: UEFI secure boot"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -202,9 +202,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: TPM v2.0",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: TPM v2.0"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -219,9 +219,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: TPM empty PCRs",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: TPM empty PCRs"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -236,9 +236,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: UEFI platform key",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: UEFI platform key"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -253,9 +253,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: BIOS firmware updates",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: BIOS firmware updates"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -270,9 +270,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: SPI write",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: SPI write"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -287,9 +287,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: SPI lock",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: SPI lock"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -304,9 +304,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: SPI BIOS region",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: SPI BIOS region"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -321,9 +321,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: SPI descriptor",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: SPI descriptor"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -338,9 +338,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: Supported CPU",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: Supported CPU"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -355,9 +355,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: Platform debugging",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: Platform debugging"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -372,9 +372,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: csme manufacturing mode",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: csme manufacturing mode"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -389,9 +389,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: csme override",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: csme override"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -406,9 +406,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: MEI key manifest",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: MEI key manifest"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -423,9 +423,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: CSME version",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: CSME version"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -440,9 +440,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: UEFI bootservice variables",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: UEFI bootservice variables"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -457,9 +457,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: AMD microcode signature",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: AMD microcode signature"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -474,9 +474,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: Part is fused",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: Part is fused"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -491,9 +491,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L1: SMM locked down",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L1: SMM locked down"
         }
       ],
       "category": "HSI Level 1 - Critical",
@@ -508,9 +508,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: IOMMU",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: IOMMU"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -525,9 +525,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: Intel BootGuard",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: Intel BootGuard"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -542,9 +542,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: Intel BootGuard verified boot",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: Intel BootGuard verified boot"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -559,9 +559,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: Intel BootGuard ACM protected",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: Intel BootGuard ACM protected"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -576,9 +576,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: Intel BootGuard OTP fuse",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: Intel BootGuard OTP fuse"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -593,9 +593,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: TPM PCR0 reconstruction",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: TPM PCR0 reconstruction"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -610,9 +610,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: BIOS rollback protection",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: BIOS rollback protection"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -627,9 +627,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: Platform debugging",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: Platform debugging"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -644,9 +644,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: Intel GDS mitigation",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: Intel GDS mitigation"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -661,9 +661,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: AMD platform secure boot",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: AMD platform secure boot"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -678,9 +678,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: AMD SPI write protections",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: AMD SPI write protections"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -695,9 +695,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L2: HP SureStart",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L2: HP SureStart"
         }
       ],
       "category": "HSI Level 2 - Important",
@@ -712,9 +712,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: Suspend-to-idle",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: Suspend-to-idle"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -729,9 +729,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: Suspend-to-ram",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: Suspend-to-ram"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -746,9 +746,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: Pre-boot DMA protection",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: Pre-boot DMA protection"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -763,9 +763,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: Intel BootGuard error policy",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: Intel BootGuard error policy"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -780,9 +780,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: CET Platform",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: CET Platform"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -797,9 +797,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: AMD SPI replay protections",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: AMD SPI replay protections"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -814,9 +814,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: UEFI memory protections",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: UEFI memory protections"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -831,9 +831,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L4: Encrypted RAM",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L4: Encrypted RAM"
         }
       ],
       "category": "HSI Level 4 - Complete",
@@ -848,9 +848,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L4: SMAP",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L4: SMAP"
         }
       ],
       "category": "HSI Level 4 - Complete",
@@ -865,9 +865,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L3: CET OS Support",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L3: CET OS Support"
         }
       ],
       "category": "HSI Level 3 - Recommended",
@@ -882,9 +882,9 @@
       "condition_for": "failing",
       "rules": [
         {
-          "attribute": "Firmware HSI L4: AMD rollback protection",
+          "attribute": "Firmware HSI failing",
           "operator": "matches",
-          "value": "FAIL"
+          "value": "L4: AMD rollback protection"
         }
       ],
       "category": "HSI Level 4 - Complete",