Unit 02 of 03
Frameworks
Translating an organization's own measurement into an externally readable common language, and the cost of that language in terms of evidence production: the maturity calculation of a function-based framework, the certifiable management system cycle and the items a narrowed scope leaves out, the requirements left without evidence and the controls that satisfy more than one requirement in a control-to-requirement matrix, the extra controls brought in by sector-specific requirements tied to data type, the per-system search cost of data subject rights, which level counts as evidence in an audit within the policy/standard/procedure hierarchy, and the findings that independent assurance's separation of interests brings to light.
Published Updated
Lessons
- 01 Security Frameworks The structure of a function-based framework and a maturity calculation on a fictional control set: an overall maturity of 1.35 across 5 functions, 14 categories, and 31 control items; 5 controls sitting at level 0 and one category with no working control at all; 15 of 31 controls producing evidence for 25 evidence items; a 45 person-day budget where gap priority and yield priority rank all five functions differently; and a yield-first order that raises the average by 0.07 while leaving the weakest function 0.33 behind. 14 min read
- 02 Management System Standards Running the certifiable management system model through its scope statement, statement of applicability, internal audit, and external certification cycle: in a 23-item inventory, a narrow scope leaves 25 of 100 control items unapplied, keeps 76 percent of total risk out of the certificate, and turns 15 items into an external party; a correction capacity of 20 nonconformities per round blocks certification at broad scope; and the absolute-cost order comes out the exact reverse of the cost-per-unit-of-risk order. 14 min read
- 03 Audit Control Sets Running the matrix between control and requirement: in 28 controls, 25 requirements, and 33 links, only 19 requirements carry operating evidence, 2 are mapped to no control at all, 2 are mapped but produce no evidence, and 2 rest on provider attestation only; 13 requirements stand on a single operating control; 12.3 percent of the 3,205 evidence items produced in the period are reviewed; and the control-count and evidence-load rankings share only three common members in their top five. 14 min read
- 04 Sector-Specific Compliance Requirements Tying compliance requirements to the data type, and the control-side counterpart of narrowing the scope: in 16 systems and 4 data types, the extra controls per type add up to 29 when summed separately and to 20 in the union; 9 multi-type systems carry a control load of 129; removing a type from every system drops 4 and 3 controls respectively, while removing it partially drops no controls at all; residual controls come back; and three separate measures order the same four actions in three different sequences. 13 min read
- 05 Personal Data Protection Counting data subject rights and processing principles as items: because 3 of 15 systems are not in the inventory, 6 of 7 right-request types are answered incompletely, and 28 percent of the 121 monthly requests get caught on shadow systems; a request takes between 55 and 240 minutes, and the monthly workload of 381 person-hours exceeds the 260-person-hour capacity; completing the inventory raises the load to 494.8 person-hours, data minimization lowers it to 324.9, and all 7 processing principles depend on the completeness of the inventory. 13 min read
- 06 Policy, Standard, and Procedure Separating the document hierarchy along the axis of evidence production: only 10 of 26 documents produce evidence in an audit and 9 do not carry a measurable threshold, 9 of 15 requirement chains are complete and 11 are provable, two policy-less chains remain provable thanks to a record-producing procedure, completing the missing links gains evidence for 104 person-days while 14 person-days only fix the appearance, and the rankings by document count and by evidence production diverge. 14 min read
- 07 The Function of Auditor and Compliance Roles Measuring independent assurance in terms of separation of duties: of the 17 real findings in 24 controls, only 3 are visible under self-review, and 12 of the 14 invisible findings stay hidden because of independence; the compliance function sees 8, independent internal audit 17, and sampled external audit 9 findings; full separation surfaces 14 findings while bringing 72 audit-days, 19.2 extra work-days, and 48 extra evidence items; and the rankings by findings seen and by days per finding swap places at the two ends. 12 min read