What to build and what to buy

Build what is yours, buy what is everybody's

The controls in the standard divide reasonably cleanly. Some describe your business and nobody can supply them. Some are the same in every organisation and building them is reinventing a commodity.

Where buying is almost always right

Identity and access management. Logging and retention. Endpoint protection. Vulnerability scanning. Encryption at rest and in transit. Backup.

Each is a solved problem with mature products, each requires continuous maintenance that a small team cannot sustain, and each is something an assessor has seen a hundred times and knows what good looks like.

Building any of them means becoming a security product company alongside being a manufacturer, and the second job does not stop.

Where building is the only option

The system security plan. The boundary definition. The procedures describing how your people actually work. The record of decisions and why they were taken.

These are descriptions of your organisation. A template is a starting point and a plan that is visibly a template is a finding: assessors read a great many of them and can tell.

Where it genuinely depends

Anything touching the shop floor. The equipment is specific, the processes are specific, and the products in this space are younger than the products in the categories above.

The test is whether your situation is unusual. If your machines, your file routes and your constraints look like other suppliers', buy. If they do not, a product will need so much adaptation that you are building anyway, with less control.

Maintenance, and the person who leaves

Something built in-house is maintained in-house, indefinitely, by somebody. When that somebody leaves, the maintenance becomes an archaeology project, and the assessor's question about how a control works receives an uncertain answer.

Ask, before building anything: who maintains this in three years, and what happens if they resign. If the answer is one named person and a shrug, buy.

Configuration is where the work went

A purchased product satisfies a control when configured correctly and evidenced. Neither is included, both take longer than the deployment, and the deployment is what the vendor timeline describes.

Budget the configuration and the evidence separately from the licence, or the year-one figure will be wrong by a wide margin.

If an assessor has an opinion about it, buy it

Where a control is common enough that assessors have expectations about how it is satisfied, meeting those expectations with a recognised product is faster and cheaper than defending an original approach, however good the original approach is.

Save the originality for the parts of your environment that are genuinely unusual, which on a shop floor is most of them.

The worst outcome is a half-built tool

Something started in-house, working for the demonstration, never finished, and now load-bearing. It appears in the plan as a control and in reality as a script on somebody's machine.

Assessors find these by asking how a control works and listening for hesitation. If you have one, either finish it properly or replace it, and do that before the assessment rather than during it.

Three questions before building anything

Does this describe our business, or would it be the same at any supplier? Who maintains it in three years? And would an assessor recognise the approach?

Two answers pointing at buy is enough.

The exception that has no exception

Every supplier writes their own plan. Products generate templates and a template that has not been made specific is visible immediately, both to an assessor and to anybody in the business asked to follow it.

Budget the writing as writing: somebody's weeks, not a licence.

The middle option that is really building

Open components can satisfy several of the commodity controls at low licence cost, and they carry the maintenance burden of something built in-house. Treat the decision as a build decision and apply the same three questions.

Prefer the option you can undo

Buying can be reversed with notice and an export. Building can be reversed only by building something else. Where the two are close, the reversible one is worth a premium, particularly early, when you know least about your own requirements.

Revisit the decision once

A build that made sense when nothing suitable existed may not once the market has moved, and products in the shop-floor category are changing quickly. Put a reminder two years out to ask the three questions again.

The answer is often the same and the review costs an hour.

Write down which way each decision went

A one-line record per control: bought, built, or manual, and why. It takes minutes, it answers the assessor's question about how a control is satisfied, and it prevents the same argument being had twice in eighteen months.

A manufacturer knows how to buy capital equipment

The build-or-buy question is one your business answers routinely about machines: total cost over the life, who maintains it, what happens when the supplier disappears, and whether the bespoke option is worth the dependency.

Apply the same reasoning here. The subject is unfamiliar and the decision is not.

Elsewhere in buying and budgeting

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.