Plans of action, and their limits

A documented route from a gap to a closed requirement

Where a requirement is not met, a plan of action records what is missing, what will be done, by whom, and by when. It is a normal part of this process rather than an admission of failure.

Three misreadings

A parking place. Items with no owner and a date in the distant future are not a plan; they are a list of things not being done.

Universally available. Rules govern which requirements may be deferred at all, for how long, and what minimum position must be reached. Some cannot be deferred.

Permanent. Where deferral is permitted it is for a defined period, after which the requirement is met or it is not.

Check the current rules for your level rather than assuming, because this is an area where the detail has changed.

Six fields

The requirement. What specifically is missing. The action. The named owner. The date. And what it depends on, because most slipped items slipped for a dependency somebody knew about.

Anything less produces a document that cannot be managed and that an assessor reads as decorative.

Monthly, with the programme

Reviewed as part of the reporting described in the blog entry on reporting up. Items closed with evidence, items slipping re-planned explicitly, and the count reported.

An item that has moved three times has a problem the plan is not capturing, usually resource or a dependency, and moving it a fourth time does not address that.

Evidence, then closure, in that order

An item marked complete without the artefact demonstrating it is an item that will reopen during an assessment. Attach the evidence reference to the closure and the plan doubles as part of the evidence index.

Worse than never having planned

A plan showing a date that passed eight months ago demonstrates that the gap was known, a commitment was made, and nothing happened. That is a worse position than an unplanned gap, because it establishes awareness.

Either do it, or re-plan it with a reason recorded. Leaving it is the one option with no defence.

It is a management tool before it is a compliance artefact

A maintained plan of action is the remediation backlog, prioritised, with owners and dates. Suppliers who treat it as the working document rather than as something produced for an assessor generally find both purposes served by the same effort.

Elsewhere in getting assessed

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.