Doing this with almost no money

Sequence is worth more than spend

A supplier with little money can still be assessed, and the difference between one that manages it and one that does not is usually the order things were done in rather than the amount spent.

Four things that cost nothing

Read your contract clause. It states what applies. Suppliers plan against the wrong level in both directions and the correction is free.

Draw the boundary as small as it can honestly be. Every subsequent cost scales with it. This is the highest-value hour available.

Inventory the machines and the file routes. A walk round with a notebook.

Turn on the logging you already have. Most environments have logging capability that is switched off or not retained, and retention is a setting rather than a purchase.

What to spend the first small sum on

A gap analysis against the standard, done properly. It converts an unbounded worry into a list, and a list can be worked through in an order.

Then the documentation, which is time rather than money, and which is the largest single block of assessment preparation.

Three honest economies

Manual where automatic is unaffordable. A control satisfied by a documented monthly manual review is satisfied. It is laborious and it is not a finding, provided the review actually happens and is recorded.

Existing tools configured properly. A great deal of what suppliers buy duplicates capability already licensed and unconfigured.

A smaller boundary and more inconvenience. The cheapest compliant arrangement is frequently the one that is slightly annoying to work in.

Two places where saving costs more

The plan. A weak system security plan produces findings across every family, because it is the document the assessment is conducted against.

The readiness check. Discovering a gap during the assessment costs a remediation cycle and a re-visit; discovering it a month earlier costs a month.

Buying a platform before drawing the boundary

It is the commonest expensive mistake, and it happens because a platform is a decision that can be made in a week while a boundary is a decision that requires understanding your own business.

The platform then determines the boundary, which is the wrong way round, and the supplier pays to govern systems that need not have been in scope.

The sequence, in one list

Read the clause. Draw the boundary. Inventory the machines and the routes. Turn on what you already have. Run the gap analysis. Write the plan. Remediate in the order the gap analysis gives. Collect evidence. Check readiness. Book the assessment.

Done in that order, a small budget is usually enough. Done in any other order, no budget is.

Where to look before paying anybody

The programme documentation and the underlying standard are published in full and cost nothing. Federally funded manufacturing extension services exist in the United States and provide advice to smaller manufacturers.

Reading the source first changes what you are able to ask a vendor, which is worth more than the reading time.

What a small supplier has that a large one does not

A boundary that can be genuinely small, a floor that one person can walk in an hour, and a decision-making chain of two people.

Those advantages are real and they offset a good deal of budget. Large suppliers spend heavily on the co-ordination that a ten-person shop does not need.

Do not wait for money to start

The free steps produce the numbers that justify the spending, so waiting for a budget before beginning inverts the order. Suppliers who start with the clause and the boundary usually find the eventual budget smaller than they feared.

A folder and a habit

A boundary diagram, an inventory, a plan written by somebody who works there, and a monthly hour spent collecting evidence into a folder that is named sensibly.

That is unglamorous, it is most of what an assessment examines, and it costs a morning a month.

If you take one thing from this entry

The boundary is drawn before anything is bought. Every cost in the programme scales with it, it is free to get right, and it is the decision most often made by accident.

On somebody reading your clause properly

An hour of qualified attention on what your specific contracts require is the cheapest thing on this list with the largest range of outcomes, because the commonest expensive error is preparing for the wrong level.

Finish the free steps in a fortnight

Spread over six months they stall, because nothing forces them. Done in two weeks they produce a boundary, an inventory and a gap list, and that package is what unlocks everything else.

Small is an advantage here and it does not feel like one

Fewer systems, fewer people, a shorter chain of decisions and a floor one person can hold in their head. Every one of those makes the boundary easier to draw and the evidence easier to keep current.

What small suppliers lack is not capability but somebody whose job this is, and the entry on ownership in the next part is about the smallest version of that role that works.

Elsewhere in buying and budgeting

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.