it would be helpful to include the FDE recovery key escrow status (rather than the key itself) as well as the firmware password status.
As a company policy, we'd like to enforce these and check who forgot to turn it on or off. Going through devices one by one is quite hard.