The certificate, and what it covers

A certification at a level, for a scope, for a period

Three things, and the middle one is the part suppliers pay least attention to and customers read most carefully.

The scope statement records what was assessed: which systems, which locations, which parts of the organisation. Work performed outside it is not covered by the certificate, whatever the certificate says at the top.

Four things assumed and not true

Other sites. A certification covering one facility does not extend to another unless it was in scope.

Subsidiaries and related companies. Separate legal entities are separate unless assessed together.

Work outside the boundary. Which is the point of the boundary and is worth restating, because the commercial temptation is to present the certificate as covering the business.

Your suppliers. Your certification says nothing about theirs, and the flow-down obligation remains yours.

What to say to a customer

The level, the scope in a sentence, the date of assessment and the expiry. That is what a customer needs and it is what a careful one will ask for.

Claiming more than the scope supports is the kind of statement that is checked, and being found to have overstated a certification is worse commercially than not holding one.

The obligation between assessments

Where continued compliance must be affirmed periodically, that is a statement by a named individual that the controls remain in place. It should follow a check rather than a calendar reminder, and the blog entry on staying compliant describes the check.

Customers and contracting officers can see your status

Status recorded in government systems is visible to the people deciding who to award work to and to primes assessing their supply chain. It is, in effect, a public fact about your business.

Which is an argument for keeping it accurate and for being able to explain it, including the parts that are not yet complete.

Nothing, and that is the point

The controls that were operating continue operating. The evidence that was being collected continues being collected. A certificate is a statement that a state existed at a moment, and it holds its value only while that state persists.

Organisations that experience certification as an ending find the next assessment considerably harder than the first.

What twenty-four entries have argued

That the requirement is published, finite and readable. That the difficult part is not implementing controls but being able to show a stranger they operated over a period. That the boundary decision governs everything downstream. And that on a shop floor the standard fits worst and the ordinary practices matter most.

None of that requires a vendor. Some of it is easier with one, and saying which parts is why this site marks its own claims.

Elsewhere in getting assessed

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.