Reading a proposal that quotes a certificate

Nobody can sell you a certificate

Certification is issued after an assessment conducted by an accredited third party or by the government. A vendor is not that party and cannot be, so a proposal offering certification is offering preparation and calling it something else.

That is not necessarily dishonest. It becomes dishonest when the proposal implies an outcome, and it becomes expensive when a supplier buys on that implication and discovers the assessment is a separate engagement with a separate fee and a waiting list.

Reading the language

"Compliant platform." The platform implements controls. Your use of it may or may not satisfy the requirement, which depends on your configuration, your documentation and everything outside the platform.

"Inherited controls." Some controls are satisfied by the underlying infrastructure and you inherit the evidence for them. Real and useful. Ask for the list, and ask which controls remain yours, because that second list is the work.

"Assessment ready in X weeks." A statement about their deployment, not about your readiness.

"Guaranteed certification." Ask what the guarantee pays out and on what evidence. In most proposals the answer is a discount on further services.

Ask for it in writing, control by control

Any serious vendor can produce a matrix showing, for each requirement in the standard, whether it is satisfied by them, by you, or shared.

Ask for it before signing. Three things follow from reading it. You learn how much work remains yours, which is usually more than the demonstration suggested. You learn whether the vendor has actually mapped their product to the standard. And you acquire a document an assessor will want to see anyway.

A vendor who cannot produce one has not done the mapping, and you would be doing it for them at your own cost.

What to ask to see

Not the dashboard. Ask to see the evidence the system produces: the actual export, for an actual control, in the form an assessor would read it.

Then ask how that export is generated when the person who knows the product has left. Evidence that requires a specialist to produce is evidence you will not have in year three.

Ask for one that has been assessed

A reference customer who has been through an assessment with this product in place is worth ten who have merely deployed it. Ask what the findings were and how the product featured in them.

If the vendor has no assessed customers, that is worth knowing and is not disqualifying for a young product; it means you are the test.

Ask for one, and define what it proves

A pilot with no stated success criterion becomes a demonstration with a longer runtime. Write down in advance what it must show: which controls, which evidence, on which of your machines.

A vendor who agrees to that has confidence in the product. One who prefers a general trial is buying time in your building.

What happens to your evidence if you leave

Ask where the evidence lives, whether you can export it in a form that remains readable without the product, and what happens to historical records at the end of the contract.

Compliance evidence you cannot take with you is a dependency that grows every year you stay, and it should be priced as one.

What a good one looks like

It states which controls it addresses and which it does not. It separates licence, implementation and recurring cost. It assumes and states an amount of your time. It names what would change the price. And it says somewhere that certification is issued by somebody else.

Proposals like this exist and they read as less confident than the alternative, which is a problem for the vendors who write them and an advantage for the buyers who receive them.

Normalise before comparing

Put both proposals on one page with the same rows: the seven cost lines from the entry on cost, over three years, with internal time priced. Most comparisons that look close stop looking close at that point.

What would make you tell us not to buy this

Ask it directly. A vendor with an answer has thought about where their product does not fit, which is the same signal as a provider who talks a client out of an unsuitable role.

A vendor with no answer has one product and every problem looks like it.

Have somebody technical and somebody commercial read it

The technical reader finds what the product does not do. The commercial reader finds what the contract does not commit to. They are different omissions and a single reader finds one of them.

Where only one person is available, read it twice with the two questions held separately, a day apart.

It becomes evidence later

The responsibility matrix and the control mapping in a proposal are documents an assessor may want to see. File them where the compliance evidence lives rather than in a procurement folder nobody opens.

Elsewhere in buying and budgeting

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.