Compliance and continuity

From requirement to technical control

Every measure a standard asks for has to become something that exists in the system: who has access to what, what gets recorded, where the backups are and how you prove they work. The mapping between the clause and the piece of infrastructure that satisfies it must be written and maintained, or by the second audit nobody remembers it.

In practice a large share of the controls is infrastructural: when the layer underneath is already covered, the company can concentrate on the organisational controls — policies, training, processes — that remain its own.

Evidence that collects itself

Append-only event log, incident history with what was done and when, security score and a periodic report generated by the system. If producing evidence needs a person exporting by hand, that evidence will arrive late and contestable.

How long until we are back up

Recovery objectives declared per service (how much time, how much data) and periodic drills that actually measure them. A number written in a plan and never verified is a wish; a number that came out of a drill is a commitment.

Important decisions leave a short record: context, alternatives, choice, consequences. That is what lets you change your mind in an informed way three years later.