The documents an assessor reads first

The system security plan

One document describing the environment and stating, for each security requirement, how it is met. It is the thing the assessment is conducted against: an assessor reads it, then examines whether what it says is true.

Which has a consequence suppliers underestimate. A plan that overstates produces findings across every family it touches. A plan that is accurate about a gap, with a documented route to closing it, is in a far better position than one that claims the gap does not exist.

Five parts

A description of the system and what it does. The boundary, with the diagram and the reasoning. An inventory of what is inside it. For each requirement, how it is implemented in this environment. And the references to where the evidence for each sits.

The fourth part is where templates fail. A sentence restating the requirement is not a description of implementation, and an assessor reads several plans a month and recognises the pattern immediately.

Four that are read alongside it

The plan of action, covering unmet requirements.

Network and data flow diagrams, which should agree with the boundary description rather than approximately resemble it.

The asset inventory, which is the document most often incomplete, usually because the shop floor was omitted.

Policies and procedures, which need to describe what the organisation does rather than what a template author imagined.

By somebody who works there

A plan written entirely by an outside consultant describes a generic organisation, and the interviews will not match it. A plan written internally with specialist help on the structure describes this business, and the interviews confirm it.

The difference is visible in the first ten pages and it is the single strongest predictor of how the week goes.

A living document, awkwardly

Environments change and plans do not update themselves. A plan describing a system that was decommissioned last year is a finding, and it is also a signal to the assessor about everything else.

Attach plan review to the change process from the blog entry on staying compliant, and review the whole thing annually regardless.

As long as it needs and no longer

Plans of several hundred pages are common and much of the bulk is restated requirement text. It makes the document harder to maintain, harder to read and no more persuasive.

What the assessor wants for each requirement is a short, specific, true description of what happens here and where to see it.

The document that makes the week work

A table mapping each requirement to the evidence and where it lives. It is not glamorous, it takes a day to build, and it converts an assessment from a search into a review.

Assessors notice its absence more than its presence.

Elsewhere in getting assessed

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.