Drawings, job packets and paper

Media protection covers paper

Most programmes treat this as a question about systems and forget that the requirements on media apply to physical media as well as digital. A printed drawing carrying controlled information is covered information on a sheet of paper.

On a shop floor there is a great deal of paper, it moves around, and almost nobody has thought about it.

Six places to look

• Job packets and travellers, printed at the start of a run.
• Drawings taped to machines or pinned above benches.
• Inspection reports and first-article documentation.
• Setup sheets and tooling lists derived from the drawing.
• Whiteboards with dimensions written on them.
• The recycling bin.

The last is the one that produces the clearest finding, because a skip of drawings behind the building is a control failure anybody can see.

The marking travels with the sheet

Where information arrives marked, the marking is part of it, and derived documents carrying the same information generally need the same treatment. A setup sheet transcribing controlled dimensions is not uncontrolled because somebody retyped it.

This is the point most often missed on a floor: the protection attaches to the information, not to the original document.

Four practical arrangements

Print only what is needed, when it is needed. A packet printed for the run and destroyed at the end is a smaller problem than one that lives in a folder.

Store it somewhere with a lock. Physical protection requirements are met by ordinary means: a cabinet, a controlled area, a sign-out sheet.

Destroy it properly. Cross-cut shredding or a contracted destruction service with a certificate. The certificate is the evidence.

Account for it. Where a document is issued to the floor and not returned, somebody should notice.

What is visible from where

Drawings on a bench beside a route visitors take, or a screen facing a window, are disclosures without a system involved. This is a floor plan question and it is answered by walking the visitor route and looking at what a stranger would see.

Most suppliers doing this find two or three things and fix them the same afternoon.

The terminal at the machine

A controller displaying a controlled program is displaying controlled information. Positioning, timeouts and who can walk up to it are the same considerations as for paper, and they cost nothing to address.

What to be able to show

A procedure covering printing, storage, marking and destruction. The destruction certificates. The sign-out records if you use them. And somebody who can explain the arrangement to an assessor without consulting the procedure.

The last is the test that matters, because a procedure nobody on the floor can describe is a document rather than a control.

The people who print are not the people who wrote the policy

Job packets are produced by planners and printed by supervisors. Neither typically attends a compliance briefing, and both make daily decisions about what gets printed and what happens to it afterwards.

Ten minutes with them is worth more than a procedure, and it is the conversation that establishes whether the arrangement can work at all.

The phone on the floor

Operators photograph setups, defects and drawings routinely, for entirely good reasons: to show a colleague, to record a problem, to remember a fixture. Those photographs are copies and they sit on personal devices.

The answer is rarely a ban, which fails as reliably as the removable media ban. It is providing a sanctioned way to capture and share images that is as quick as the phone.

Walk the floor with a bag

Collect every sheet carrying controlled information that is not where it should be. The pile is the finding, it is undeniable, and it makes the case for the arrangement better than any policy draft.

Elsewhere in the shop floor

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.