Working to two standards at once

Most suppliers meet more than one

A defence manufacturer may face the certification requirement, a customer's own security schedule, an information security management standard demanded by a commercial client, and requirements attached to handling export-controlled technical data.

The overlap between them is substantial and it is not identity, and the difference between treating them as one programme and as several is most of the cost.

Implement once, evidence once, map to each

The working approach is a single set of controls implemented in your environment, a single evidence store, and a mapping showing which control satisfies which requirement in which framework.

The alternative, running two programmes, produces two sets of documents describing the same environment, two evidence collections that diverge, and an obvious question from whichever assessor notices.

An aid, not an authority

Published crosswalks between frameworks exist and are useful for planning. They are approximate: a control that satisfies one framework's requirement may satisfy only part of another's, and the wording of the underlying obligation governs.

Use a mapping to avoid duplicate work and never to argue with an assessor. They assess against their standard and a crosswalk is not a defence.

Three real frictions

Scope. Frameworks define their boundaries differently, and a scope drawn for one may be wrong for another. This is the conflict that costs most and it is worth resolving before implementing anything.

Evidence format. One auditor wants a policy, another wants a record of the policy operating. Collecting both from the start is cheaper than retrofitting.

Cycles. Different validity periods and audit dates mean the evidence has to be continuously current rather than assembled before a known date, which is better practice anyway and is more work.

The same person who owns the programme

Splitting frameworks between owners recreates the two-programme problem with a co-ordination meeting attached. One owner, one control set, one mapping document that is maintained rather than produced once.

Do the strictest first, usually

Where one framework is a superset in a given area, satisfying it tends to satisfy the others there. That is not universal and it is a reasonable default.

The exception is where a contractual date makes one framework urgent and the others are not. Then the date governs and the mapping tells you what you have incidentally achieved for the rest.

Which regimes apply to you

This entry describes the shape of running several at once. Which apply to your organisation, and what each obliges, depends on your contracts and on the nature of your technical data, including whether export control regimes are engaged.

Those are questions for qualified advisers in each area. Nothing here is legal, export or compliance advice, and the interaction between these regimes is exactly where a general summary is least safe to rely on.

One place, organised by control rather than by framework

Filing evidence under the framework that prompted it guarantees duplication. Filing it under the control it demonstrates, with tags for the frameworks it serves, means one artefact answers several auditors.

This is a decision taken in the first fortnight and expensive to reverse in year two.

Do not let them meet your documents cold

Where the same environment is examined against two frameworks, give each auditor the mapping and say plainly which controls you are presenting against their requirement. That is helpful and it is also protective: it prevents an artefact written for one framework being read as an answer to the other and found wanting.

It is real and it arrives late

The second framework costs far less than the first, and the saving appears only if the first was implemented with mapping in mind. A supplier who expects to face several should say so at the start, because the decisions that produce the saving are all taken early.

Build it before implementing, not after

A mapping produced at the end is an exercise in explaining what you did. Produced at the start it changes what you do: controls get implemented in the form that satisfies the strictest framework, and evidence gets collected in the format each will want.

It takes a few days with the standards open and it is the single highest-return document in a multi-framework programme.

Elsewhere in running the programme

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.