The ISO standards that turn obligations into evidence.

General counsel · Compliance leaders · Security leadership

Your policy set is fine. Now name who can override it.

A policy set is not a document set. It is a map of who is allowed to say yes. Most programmes can produce a signed policy within minutes. Very few can produce, as quickly, the name of the person entitled to grant an exception to it, and on what basis. That second answer is the control.

In governance terms, a policy is a delegation instrument: what management decided, who must comply, and who may authorise a departure. A policy without a documented exception route does not eliminate exceptions. It drives them underground, granted informally and never reviewed.

Why it matters: When a control fails, the first question is whether the rule existed. The second, and harder, question is who was allowed to set it aside.

A policy nobody can be granted an exception from is a policy everybody quietly breaks.

Question for practitioners: Does your organisation track policy exceptions with the same rigour it tracks incidents?

Security leadership · Governance leaders · Boards

Most control failures are not effort problems. They are assignment problems.

You can delegate the task. You cannot delegate the accountability. In my experience, most control failures are not failures of effort. They are failures of assignment. Nobody was doing it badly, because nobody was doing it at all.

There is a second requirement that is quietly demanding. Whoever holds a security role must be competent for it and supported to stay current. That converts a name in a document into a training obligation, a budget line and a succession question.

Why it matters: A control with no owner is not a weak control. It is an unmanaged risk with a reference number.

A department cannot be held accountable. Only a person can.

Question for practitioners: Can every control in your Statement of Applicability be traced to a person, rather than to a team?

Audit leaders · Risk managers · Security leadership

One person. Three powers. No control.

Segregation of duties is a fraud control before it is a security control. It assumes collusion, not carelessness. That assumption changes the design. Controls built for error tolerate a single trusted operator. Controls built for collusion cannot.

For smaller organisations, the honest position beats the aspirational one. Full segregation is often impossible, and the guidance anticipates this, pointing to monitoring, audit trails and management supervision. What is not acceptable is silence. An assessor will accept a documented compensating control, not an unexamined conflict.

Why it matters: The combinations you never mapped are the ones that will be found by someone who did map them.

If one person can start it, approve it and hide it, that is not a control. It is a trust arrangement.

Question for practitioners: Where segregation is impossible in a small team, what compensating control would you defend to an assessor?

CXOs · HR-facing governance · Security leadership

Your team does not follow the policy. It follows the manager.

Every control has two owners. The person who designed it, and the manager who decides whether it survives contact with reality. Most security programmes invest heavily in policy creation, awareness campaigns and control design. Far fewer examine the daily decisions that determine whether those controls are followed when deadlines tighten, budgets shrink or operational pressure increases.

When a manager approves an exception without challenge, ignores repeated non-compliance, rewards delivery achieved through control bypass, or removes security activities from a project plan to meet a deadline, a message is communicated more clearly than any awareness programme could ever deliver. People learn what leadership tolerates, not what leadership publishes.

Why it matters: Most organisations do not have a policy culture. They have a management culture, and employees eventually align with whichever one is stronger.

A control enforced occasionally is a recommendation. A control enforced consistently becomes part of how the organisation operates.

Question for practitioners: If an employee ignored a security requirement today, would the response depend on the manager involved, or would it be consistent across the organisation?

DPOs · General counsel · Incident leaders

The notification clock starts before anyone decides who can start it.

The worst time to establish a relationship with a regulator is during the incident that requires you to notify them. This control is usually read as a law enforcement provision. It is broader than that, and its real value is pre-incident rather than post-incident.

That reframes the control. It is not only an escalation path. It is an early warning system for changes that will affect your obligations before they arrive as a compliance deadline. The difficulty is never the phone number. It is the decision. Notification clocks tend to start from awareness, not certainty, and internal escalation frequently consumes the time meant for assessment.

Why it matters: The clock does not pause while you decide who is allowed to start it.

A contact list is not a notification capability.

Question for practitioners: Do you know today, by name, who you would contact and within how many hours?

Security leadership · Risk leaders · Audit leaders

Every incident teaches two organisations. Only one of them pays.

The most expensive security mistake is learning alone. Every major incident teaches two organisations: the victim, and everyone else paying attention. That is the logic behind this control.

There is also a governance benefit. External communities expose assumptions that become invisible internally. Teams working within the same environment for years often stop questioning established practices. Professional groups provide comparison points that reveal gaps, emerging practices and alternative approaches before an auditor, regulator or attacker discovers them.

Why it matters: An organisation that learns only from its own incidents is paying for knowledge at full price.

The cheapest lesson is the one experienced by somebody else.

Question for practitioners: What important security decision in the last year was influenced by insight gained outside your organisation?

Security leadership · Boards

You did not buy threat intelligence. You bought a subscription.

Buying a threat feed is not threat intelligence. It is a subscription. Introduced in the 2022 revision, this is one of the most commonly claimed and least commonly evidenced controls in the set. Intelligence becomes a control at the point it demonstrably changes a decision. Before that, it is data with an invoice attached.

That is the sentence with governance consequences. If your intelligence never reaches your risk register, your risk assessment runs on last year’s assumptions while your defences run on this morning’s.

Why it matters: Intelligence that reaches nobody with authority to act is an expensive newsletter.

Collection is a capability. Consumption is the control.

Question for practitioners: Can you point to one control you changed because of threat intelligence in the last quarter?

CXOs · Programme leaders · Privacy architects

A security gate that cannot stop a launch is a viewing platform.

Security requirements are cheapest at design and most expensive the week before launch. This control is an economics control wearing governance clothing.

That scope is routinely ignored. Security review attaches to technology delivery and detaches from the office relocation, the outsourcing programme and the new customer onboarding process, all of which move information. The guidance expects risks assessed early and periodically across the project lifecycle, requirements addressed in the early stages, and treatment effectiveness reviewed and tested rather than assumed. It also expects a governance body, such as a steering committee, to follow up at defined stages.

Why it matters: Every control retrofitted after launch is paid for twice, once in build and once in disruption.

A security gate that cannot stop a project is not a gate. It is a viewing platform.

Question for practitioners: Which projects in your organisation went live last year without a security decision on record?

Security leadership · DPOs · Audit leaders

An 80% asset inventory caps every control you built on top of it.

If your asset inventory is eighty percent complete, what is your Statement of Applicability worth? Every downstream control inherits the completeness of this one. Classification, access control, retention, deletion, incident scoping and breach assessment all assume you know what you hold. Where the inventory is partial, that assumption caps the assurance value of everything built on it.

Ownership carries the governance weight. The guidance sets real duties for an owner: the asset is inventoried, classified and protected, classification is reviewed, access restrictions match it, and disposal is handled securely and reflected in the register.

Why it matters: You cannot protect, classify, retain or report on what you never counted.

An incomplete inventory does not weaken one control. It caps them all.

Question for practitioners: When your inventory was last reconciled against discovery, what did it miss?

General counsel · HR-facing governance · Security leadership

The rule nobody was told about is a defence you will lose.

An acceptable use rule nobody was told about is not a rule. It is a defence you will lose. This is where enforceability is built. When an organisation acts on misuse, the question is rarely whether the behaviour was unacceptable. It is whether the person was told, in terms they acknowledged, beforehand.

That monitoring disclosure is the sentence most organisations under-write, and the one with employment and privacy consequences in several jurisdictions.

Why it matters: Your disciplinary and contractual remedies are only as strong as the acknowledgement behind them.

You cannot enforce a standard of behaviour you never asked anyone to accept.

Question for practitioners: Would your acceptable use rules survive a challenge from someone who says they were never told?

HR-facing governance · General counsel · Security leadership

The riskiest fortnight in the employment lifecycle is the notice period.

Most exit processes are built for the last day. This control asks that personnel and other interested parties return the organisation’s assets when employment, a contract or an agreement changes or ends. Read narrowly, it is a hardware checklist. Read as written, it is far more demanding.

Why it matters: The guidance is candid that information on assets you do not own is hard to retrieve, and that access rights and cryptography may be the only lever left.

Recovering the laptop is easy. Recovering what was copied off it is not.

Question for practitioners: Does your exit process start on the resignation date, or on the last day?

DPOs · CPOs · Governance leaders

Classification is a proportionality engine, not a security dial.

Over-classify and you pay for controls nobody needed. Under-classify and you transfer the risk to your customer. The guidance says this almost directly: over-classification leads to unnecessary controls and expense, while under-classification leads to insufficient protection. Both are failures. Only one feels like diligence.

There is a cross-border point that rarely reaches the design conversation. The guidance notes that schemes differ between organisations even where level names look identical, so sharing agreements should include procedures for interpreting another party’s levels.

Why it matters: Classification is what makes every downstream control proportionate rather than uniform.

A label that means something different in your supplier’s organisation is not a control. It is a misunderstanding waiting for an incident.

Question for practitioners: How many of your classification levels does your organisation genuinely treat differently?

Privacy architects · DPOs · Security leadership

Labels are not decoration. They are instructions your systems are supposed to obey.

This control turns classification from a policy statement into something automation can act on. It is consistently underbuilt because it looks cosmetic.

That metadata requirement is the dependency behind data loss prevention, rights management and automated retention. Where labelling is weak, those tools guess. A counterpoint the guidance raises is worth stating publicly: labelling can have negative effects, because classified assets become easier for an attacker to identify and target.

Why it matters: Automated protection cannot enforce a classification it cannot read.

If your systems cannot read the label, it is only advice.

Question for practitioners: Are your labels decorative, or instructions your systems obey?

General counsel · DPOs · Contract leaders

Every information transfer policy I have studied covers email. Most cover couriers. Very few cover what people say out loud.

The standard asks for transfer rules, procedures or agreements covering all types of transfer facility, within the organisation and with other parties. The guidance then does something unusual: it splits the control into electronic transfer, physical storage media transfer and verbal transfer. That third category is where the gap sits.

Why it matters: The channel with no rule is the channel with no evidence.

You cannot secure a transfer method you have never acknowledged exists.

Question for practitioners: When did your organisation last write a rule about what people say out loud?

Security leadership · Privacy architects · Boards

Access control is not a technology decision. It is a posture decision, and it is made once.

The guidance sets out two competing premises. The stronger rule is that everything is generally forbidden unless expressly permitted. The weaker rule is that everything is generally permitted unless expressly forbidden. Most organisations believe they run the first and can evidence the second.

Why it matters: An access model nobody can trace to a business requirement cannot be defended.

Granularity is not free, and nobody budgets for it afterwards.

Question for practitioners: Is your default posture permit-unless-forbidden, or forbid-unless-permitted, in practice rather than on paper?

Security leadership · Privacy architects · Audit leaders

Shared accounts do not break access control. They break attribution, which is worse, because the control still appears to be working.

Identity is the unit of accountability. Every log entry, access review and investigation resolves to the question of who. Where identity is ambiguous, the answer is a system name.

Why it matters: You cannot investigate an action you cannot attribute to a person.

Every unowned machine identity is a decision nobody remembers.

Question for practitioners: Who approves your machine identities, and who reviews them afterwards?

Security leadership · Service desk owners · Audit leaders

Credentials are rarely broken. They are handed over.

The failure point is almost never the algorithm. It is the process around issue, reset and recovery, where a person decides whether the requester is who they claim to be.

There is a balanced point on single sign-on and vaults worth taking to a board. They reduce the number of secrets a person must protect, which increases effectiveness. They also concentrate impact if disclosure occurs.

Why it matters: Attackers need not defeat authentication if the service desk will reset it.

Every credential process ends with a person deciding whether to believe.

Question for practitioners: How is identity verified before a password reset?

Audit leaders · Security leadership · HR-facing governance

Provisioning is easy. De-provisioning is where organisations get caught.

The standard asks that access rights are provisioned, reviewed, modified and removed in line with the access control policy. Four verbs. Most programmes evidence the first and struggle with the rest.

That risk-factor provision is a rare instance of a security standard acknowledging human context. The guidance is direct that in management-initiated terminations deliberate damage is a real risk, and that people resigning may be tempted to collect information for future use.

Why it matters: The account nobody removed is the one nobody watches.

Access granted for a reason that has ended is simply exposure.

Question for practitioners: How long does a leaver keep access, measured rather than assumed?

Procurement leaders · General counsel · DPOs · Security leadership

Outsourcing moves the work. It does not move accountability.

The guidance states this plainly, and it is the sentence I would put in front of any executive weighing a major outsourcing decision: legal and contractual responsibility for protecting the information remains with the organisation.

The guidance is also realistic about power imbalance. Where an organisation cannot impose requirements, it should factor that into selection and implement compensating controls based on risk. That is documentable, and far stronger than pretending terms were accepted.

Why it matters: Your customers and regulators will hold you accountable, not your vendor.

You can outsource the processing. You cannot outsource the answer.

Question for practitioners: Have you read the scope statements on your suppliers’ certificates?

General counsel · Contract leaders · Procurement leaders

Security requirements that are not in the contract are not requirements. They are hopes with a project plan attached.

Most organisations run a thorough supplier assessment at onboarding. Questionnaires, evidence review, sometimes a site visit. Then the agreement is signed with one line about appropriate technical and organisational measures. The assessment was diligence. The contract was meant to be the control.

Three provisions decide your exposure when something goes wrong. Notification timing. Audit and assurance rights. Exit obligations covering return, destruction and continuing confidentiality. Everything else is comfort.

Why it matters: Outsourcing moves the work, not the accountability.

You cannot enforce an obligation you never wrote down.

Question for practitioners: What is the notification window in your most critical supplier agreement, and does it fit yours?

Supply chain · Procurement · Security

You cannot outsource accountability to a supplier, and you cannot inherit assurance you never asked for.

This control is about the products and services that make up your technology estate before they ever reach a contract review. Hardware, software, components and the services wrapped around them arrive through a chain of vendors, resellers, integrators and upstream developers. The control asks you to define and apply security requirements to that chain rather than assume the party you signed with has handled everything behind them.

Software composition is where this control most often bites. An application assembled from hundreds of open source packages has a supply chain whether or not anyone has drawn it, and the organisation that cannot enumerate those components cannot answer a question about a newly disclosed vulnerability in one of them.

Why it matters: Most significant incidents of the last few years entered through a trusted channel rather than the perimeter. The supply chain is the route that bypasses controls because the component is already trusted by design.

A supply chain you have never mapped is not short. It is simply unmeasured.

Question for practitioners: When a widely used library is found vulnerable, how long does it take you to say with confidence whether you are affected?

Vendor management · Assurance · Operations

A supplier assessed once at onboarding and never revisited is an assumption, not an assurance.

Due diligence at selection tells you what a supplier looked like on the day you asked. This control governs everything after that. Services change, subcontractors change, staff change, and the risk profile you accepted at signature drifts quietly away from the one you are actually running.

Change is the harder half of this control. A supplier that migrates your data to a different region, replaces a subprocessor or restructures its support model has changed your risk position even if the service looks identical from outside.

Why it matters: Concentration risk in a small number of providers means supplier drift is now one of the most direct routes to an organisational incident, and it is a route that produces no alerts.

The supplier you assessed and the supplier you are using are two different organisations separated by time.

Question for practitioners: For your most critical supplier, what changed in the last twelve months that you found out about from the supplier rather than by accident?

Cloud · Architecture · Governance

Shared responsibility is only shared if both parties know which half is theirs.

This control was introduced in the 2022 revision and recognises something that had become obvious in practice: cloud consumption is not simply another supplier relationship. The acquisition, use, management and exit of cloud services has its own lifecycle, its own configuration risk and its own failure modes, and it deserves explicit treatment rather than being folded into general outsourcing.

Exit is the clause everyone agrees to and nobody tests. Knowing the export format, the retention period after termination and the cost of extraction is a governance question, not a procurement footnote.

Why it matters: Cloud has become the default operating environment, which means the quality of your cloud governance is now the quality of your security programme.

The provider secures the building. You still decide who gets a key and which doors you leave open.

Question for practitioners: If your primary cloud provider terminated your contract with ninety days notice, do you know what leaving would actually involve?

Incident response · Resilience · Governance

The plan you write calmly is the only plan you will have when nothing is calm.

This is the first of five controls that run as a connected sequence. A.5.24 through A.5.28 describe the incident lifecycle in order: prepare, assess, respond, learn, collect evidence. Read individually they seem repetitive. Read in sequence they are a complete operating model, and this first control is the foundation the other four stand on.

Communication planning is the part most often thin. Who authorises a statement, who speaks to a regulator, who tells affected individuals and in what order are decisions that should not be made for the first time under pressure.

Why it matters: The first hour determines how the rest of the incident goes, and that hour is governed entirely by decisions made long before it started.

Preparation is what converts an emergency into a procedure.

Question for practitioners: If a serious incident began at two in the morning on a public holiday, who gets woken up, and who decides that?

Security operations · Triage · Incident response

Every incident begins life as an event that somebody had to classify correctly.

The second control in the sequence covers the moment of judgement. Events arrive constantly from monitoring tools, users, suppliers and automated alerts. Most are noise. Some are not. This control governs how you decide which is which, and it is the point where a manageable situation is either caught or missed.

Alert volume makes this a human factors control as much as a process one. A team triaging thousands of events a week will miss the meaningful one unless the scheme actively reduces what reaches human attention.

Why it matters: Detection without correct classification delays response, and delay is the single variable that most reliably increases the cost and scope of an incident.

The breach that went unnoticed for months was usually detected on day one and filed as routine.

Question for practitioners: Would two different people on your team classify the same ambiguous alert the same way, and how do you know?

Incident response · Operations · Crisis management

Containment decisions made in the first hour are rarely revisited, so they had better be the right ones.

The third control in the sequence is execution. Once an event has been assessed and confirmed as an incident, the response must follow the documented procedures prepared under A.5.24, carried out by people with defined authority. This is where preparation either pays off or is exposed.

Regulatory clocks are unforgiving here. Several privacy regimes require notification within short fixed windows measured from awareness, which makes the classification decision in A.5.25 the moment the clock usually starts.

Why it matters: Response quality, more than incident severity, determines the eventual regulatory, financial and reputational outcome of an incident.

Under pressure, people do not rise to the occasion. They fall back to their level of preparation.

Question for practitioners: Can your responders isolate a production system right now, or do they need to find someone with permission first?

Continuous improvement · Risk · Governance

An incident you did not learn from is an incident you have agreed to have again.

The fourth control in the sequence closes the loop. Incidents are expensive sources of information about how the organisation actually behaves under stress, as distinct from how the policies say it behaves. This control requires that knowledge to be used to strengthen controls rather than filed once the service is restored.

Blame shapes the quality of the input. Where reviews are experienced as performance management, the detail that would have been most useful quietly stops being volunteered.

Why it matters: Repeat incidents from an unaddressed root cause are the clearest evidence a management system is documenting rather than improving, and auditors read them that way.

The cost of an incident is fixed. Whether you get anything back for it is a choice.

Question for practitioners: Name one control that changed because of an incident in the last year. If nothing comes to mind, what was the review for?

Forensics · Legal · Incident response

Evidence is created in the first hour and destroyed in the first hour, usually by someone trying to help.

The final control in the incident sequence addresses something with consequences far outside the security team. Incidents may lead to disciplinary action, litigation, insurance claims or regulatory proceedings. Whether evidence survives that journey intact is determined by what happens in the first minutes, and often by people acting with entirely good intentions.

Chain of custody is the detail that decides admissibility. Who handled the material, when, and how its integrity was demonstrated matters as much as the content itself.

Why it matters: Evidence that cannot be shown to be authentic and unaltered has little value in a regulatory or legal forum, however accurate it is.

You cannot decide to preserve evidence after you have finished cleaning up.

Question for practitioners: The last time you rebuilt a compromised machine, did anyone take an image first?

Business continuity · Resilience · Risk

Disruption is exactly when controls are relaxed, and exactly when that is least affordable.

This control addresses a gap that continuity planning reliably leaves open. When normal operations fail, organisations invoke workarounds: alternate sites, manual processes, temporary access, unfamiliar systems. Each is a legitimate continuity measure and each can quietly suspend the controls that normally apply. This control requires security to be planned into the disrupted state, not suspended for its duration.

Emergency access is where this most often fails. Elevated accounts issued during a crisis to keep things moving have a strong tendency to outlive the crisis that justified them.

Why it matters: Attackers act during disruption precisely because attention, staffing and controls are all diverted, which makes the disrupted state a period of elevated rather than suspended risk.

Continuity planning that restores the service but not the controls has only finished half the job.

Question for practitioners: After your last invocation or major outage, how long did the temporary access last?

ICT continuity · Resilience · Operations

A recovery objective nobody has tested is a target, not a capability.

The final control in this instalment was introduced in the 2022 revision and closes a longstanding gap between business continuity management and the technology that continuity actually depends on. Business impact analysis produces recovery objectives; this control requires ICT to be demonstrably capable of meeting them.

Dependency mapping is what makes the objectives credible. A system with a four hour objective that depends on an authentication service with a twenty four hour objective does not have a four hour objective.

Why it matters: Recovery capability is one of the few security properties that is binary in practice. It either works on the day or it does not, and the day is a poor time to find out.

Untested recovery is a belief. Tested recovery is a control.

Question for practitioners: For your most critical system, when did someone last complete a full restore and time it?

General counsel · DPOs · Compliance

This is the highest-leverage control in the entire annex. It is also one of the least discussed.

The control asks that legal, statutory, regulatory and contractual requirements relevant to information security, and the organisation’s approach to meeting them, are identified, documented and kept current. Its importance comes less from what it requires than from what depends on it.

Cryptography receives its own treatment, and it is the part legal teams rarely see coming. The guidance flags restrictions on import or export of hardware and software with cryptographic functions, restrictions on use, methods by which national authorities may seek access to encrypted information, and the validity of digital signatures and certificates. It advises taking legal advice where encrypted information or cryptographic tools cross borders.

Why it matters: An obligations register nobody has touched in two years is a control that has stopped working, and every control downstream is only as current as this one.

Every control downstream is only as current as this one.

Question for practitioners: Who owns your obligations register, and when did it last change?

General counsel · Procurement · Executive

This control protects your intellectual property and constrains your use of everyone else’s. Most programmes implement one direction only.

Intellectual property sits in the annex because it is an information handling obligation with financial and criminal consequences attached. The control runs in both directions, and the outbound direction is the one most organisations have actually built.

That second provision is worth stating plainly, because it is the same provision this series is built to respect. It is why these instalments use control identifiers as reference labels and write every explanation in original words rather than reproducing the text of the standard.

Why it matters: The guidance notes that copyright infringement can lead to legal action involving fines and criminal proceedings, which makes licence exposure a financial risk that arrives dressed as a legal one.

Licence exposure is a financial risk arriving as a legal one.

Question for practitioners: Do you know the licence terms of the open source components inside your product?

General counsel · DPOs · Records owners

Records are evidence and liability at the same time. Your retention schedule decides which one you are holding.

This control governs the records the organisation must be able to produce and the records it should no longer be holding. Both failures are expensive, and they are caused by the same absence of a schedule that systems actually enforce.

Where electronic storage is used, procedures should ensure records remain accessible throughout the retention period in both media and format readability, guarding against loss caused by future technology change. And the one that catches organisations years later: cryptographic keys and programs associated with encrypted archives or digital signatures should be retained for as long as the records themselves, so the records can still be decrypted. An encrypted archive whose key was rotated away is not a retained record. It is an unreadable file carrying a retention label.

Why it matters: Retention is a legal obligation in both directions, to keep and to dispose, and a schedule that exists only as a document enforces neither.

An encrypted archive whose key was rotated away is not a retained record.

Question for practitioners: Could you still decrypt your oldest retained archive today?

DPOs · Chief privacy officers · Privacy counsel

A certified management system does not make an organisation privacy compliant. It makes it capable of being privacy compliant.

This is the hinge control of the organisational theme. It sits inside a security standard and points outward, asking the organisation to identify and meet requirements for preserving privacy and protecting personal information under applicable laws, regulations and contracts. It is a pointer, not a programme, and reading it as a programme is the single most consequential misreading in the annex.

The translation is what matters. Lawfulness, purpose limitation, transparency, minimisation and rights handling are privacy obligations, and no security control delivers them. Confidentiality, integrity, availability and resilience are what security contributes. That contribution is real, and it is partial.

Why it matters: A management system shows you protected the data. Only a privacy programme shows you were entitled to hold it in the first place.

Security answers how well. Privacy answers whether you should at all.

Question for practitioners: Where does your management system end and your privacy programme begin, and who wrote that boundary down?

Audit leaders · Boards · Security leadership

Independence is structural, not attitudinal. A reviewer inside the line of authority cannot deliver assurance, however honest they are.

This control is where a management system is checked by someone with no stake in the answer. The requirement is easy to satisfy on paper and frequently unsatisfied in substance, because the test is about reporting lines rather than intent.

The trigger list is the part worth taking to a board, because it moves this off the calendar. Beyond periodic review, the guidance says to consider an independent review when laws or regulations affecting the organisation change, when significant incidents occur, when the organisation starts or changes a business, when it adopts or changes use of a product or service, and when it significantly changes its controls and procedures.

Why it matters: Assurance obtained from inside the reporting line is confirmation rather than assurance, and boards frequently cannot tell the two apart from the paperwork.

If the reviewer reports to the person who owns the thing being reviewed, the review is already compromised.

Question for practitioners: Does your reviewer sit outside the line of authority for what they examine?

Compliance · Audit · Executive

Who finds your control failures first, your managers or your auditors? The answer describes your programme more accurately than any maturity score.

This control is first line self-assurance, and it determines whether the independent review in A.5.35 arrives as a confirmation or as a discovery. The distinction is the difference between a programme that is run and a programme that is marked.

That final verification step is the one most organisations skip. An action recorded as complete is not the same as an action that worked. Two further provisions give the control teeth: managers should report their results to the people carrying out independent reviews, and corrective actions should be completed in a timeframe appropriate to the risk, with progress addressed at the next scheduled review where they are not.

Why it matters: When auditors find everything first, management is not running the controls, it is being marked on them, and the board is receiving assurance about a process nobody owns day to day.

Self-assurance is what makes independent assurance a confirmation rather than a surprise.

Question for practitioners: Who finds your control failures first?

Operations · Risk · Security leadership

This control is not bureaucracy. It is a resilience control, and it exists because memory and improvisation fail at predictable moments.

The closing control of the organisational theme addresses the gap between a process that works and a process that works only while a particular person is available. It is the least glamorous control in the annex and among the most frequently vindicated.

Document when the activity must be performed the same way by many people; when it is done so rarely that the method will have been forgotten by the next time; when it is new and presents a risk if performed incorrectly; and before handing the activity to new personnel. Those four cover almost every real failure mode, and none of them is about audit.

Why it matters: An organisation that cannot operate without one particular person has a single point of failure with a payroll number, and it will discover this on the day that person is unavailable.

Procedures exist for the day the person who knew is unavailable.

Question for practitioners: Which of your critical processes exists only in one person’s head?

HR leaders · Security leadership · General counsel

Screening is a proportionality decision constrained by law. More checking is not automatically more control.

The control expects background verification before people join and, where appropriate, on an ongoing basis. The depth of that verification is not meant to be uniform. It should reflect applicable law, ethics, business need, the classification of information the role can reach and the risk attached to that access. That makes screening a risk design exercise rather than a standard checklist owned by a vendor.

The guidance also addresses the uncomfortable operational case, where verification is incomplete but the start date has arrived. It sets out practical options including delayed onboarding, delayed issue of corporate assets, reduced access, or termination of an offer. The control is not asking organisations to pretend the gap does not exist. It asks them to govern it.

Why it matters: Screening data is itself sensitive, and a control designed to reduce insider risk can create privacy and discrimination exposure where proportionality is ignored.

Screening should be deep enough to defend the role, and narrow enough to defend the screening.

Question for practitioners: Is your screening depth based on role risk, or uniform because it is easier to administer?

General counsel · HR leaders · Compliance

The handbook informs. The contract makes the obligation enforceable.

This control expects employment agreements to state both the individual’s and the organisation’s information security responsibilities. The distinction matters because policies can change at will, while contractual enforceability depends on what was incorporated, communicated and accepted at the time.

The control also reaches beyond employees. Supplier personnel can be covered through contractual arrangements with the external party. And where responsibilities must survive the end of employment, the terms should say so for a defined period rather than relying on institutional memory.

Why it matters: The moment an organisation needs to enforce a security duty is the wrong moment to discover that the duty existed only in a policy portal.

Security obligations become real when the person can understand them and the organisation can enforce them.

Question for practitioners: Do your contracts say which security duties survive the last working day?

Security leadership · HR leaders · Boards

Completion is not competence. And awareness is not training.

The control covers three different outcomes that are routinely collapsed into one. Awareness establishes responsibility and attention. Education builds understanding. Training develops the skill to perform a task. Combining all three into a single annual module produces a completion statistic and very little assurance.

Understanding should be assessed at the end, so that knowledge transfer and programme effectiveness are tested rather than assumed. The guidance also makes a useful editorial point: explain not only what and how, but why. People retain consequences more reliably than instructions.

Why it matters: A person can complete every module on the schedule and still be unable to perform the security decision their role actually requires.

Attendance is evidence of delivery. Behaviour is evidence of effect.

Question for practitioners: Do you measure whether people learned, or only whether they clicked?

General counsel · HR leaders · Audit leaders

Consistency is the control. Without it, discipline becomes both a deterrence failure and a legal exposure.

The control expects a formalised and communicated process for responding to information security policy violations. The guidance begins with a safeguard that is easy to overlook and expensive to skip: the process should not start until the violation has been verified.

Verification first protects the individual and the organisation. Security suspicion is not evidence, and a rushed response can compromise both fairness and any later investigation, including the integrity of the evidence the organisation may need to rely on.

Why it matters: Two comparable cases with materially different outcomes can turn a security response into an employment dispute, which is a slower and more public problem than the original violation.

A process is fair only when similar facts produce explainably similar decisions.

Question for practitioners: Could you defend the consistency of your last three security disciplinary outcomes?

HR leaders · Security leadership · Access governance

Movers are often riskier than leavers. Leavers lose access. Movers accumulate it.

This control asks organisations to define, enforce and communicate the security responsibilities that remain valid after employment or duties change. Those responsibilities can include confidentiality, intellectual property and knowledge gained during the relationship.

Treating a move as a close-and-open event is more demanding than updating a job title. The old role’s access, delegated decisions, control ownership and external contact responsibilities need to end or transfer. The new role needs its own terms, access and briefing. The guidance also extends the process to supplier personnel, and expects relevant changes to be communicated to other parties, including customers and suppliers where appropriate.

Why it matters: Inherited access is visible in an access review. Inherited accountability is usually invisible until the control fails and nobody can say who owned it.

A changed title with unchanged entitlements is not a completed move.

Question for practitioners: When someone moves internally, do their old permissions and responsibilities actually go?

General counsel · Privacy counsel · Procurement

An NDA is not strong because it is signed. It is strong because its scope, duration and exit duties match the information at risk.

The control expects confidentiality or non-disclosure agreements to reflect the organisation’s protection needs, to be documented, regularly reviewed and signed by relevant personnel and external parties. Signature is the last step, not the substance.

For highly sensitive circumstances the guidance also contemplates rights to audit and monitor activity involving confidential information. That is not boilerplate. It is a control decision that has to be proportionate and legally supportable in the relevant jurisdiction.

Why it matters: An agreement that does not say how information may be used cannot reliably prove the point at which that use became unauthorised.

Confidentiality survives only as long as the agreement and the operating controls say it does.

Question for practitioners: Does your agreement say what happens to the information when the agreement ends?

Security leadership · DPOs · HR leaders

Remote work moves the security perimeter into a location the organisation does not control. It may also move the data into a jurisdiction the organisation did not select.

The control expects security measures protecting information that is accessed, processed or stored outside organisational premises. Remote work here includes telework, flexible workplaces, virtual environments and remote maintenance, not only working from home.

The most important point in this control is not technical. Not every recommendation can be applied in every jurisdiction, because local law and regulation differ, particularly on monitoring and on employer access to personal equipment. That makes remote working design a legal and employment question before it becomes a device configuration question.

Why it matters: The organisation remains accountable for information held in an environment it may neither own nor see, and accountability does not follow the device home.

Remote working is not office security at a distance. It is a different operating model.

Question for practitioners: Do you know which jurisdictions your information is being viewed from today?

Security leadership · Audit leaders · All control owners

Detection begins with whether someone is willing and able to report what they saw. Reporting friction is a control weakness.

The control expects a timely mechanism for personnel to report observed or suspected information security events through appropriate channels. The guidance says the mechanism should be as easy, accessible and available as possible, which is a design requirement rather than a courtesy.

The guidance adds an important boundary that is often missed in awareness material. Personnel should not attempt to prove a suspected vulnerability. Unauthorised testing can damage systems, obscure evidence and create legal exposure for the individual and the organisation. Report, preserve and coordinate, rather than investigate without authority.

Why it matters: People stop reporting into a system that appears to absorb information and return silence, and the organisation loses its earliest and cheapest source of detection.

A reporting channel is trusted when it is easy to use and proves that reporting mattered.

Question for practitioners: What is the median time between someone observing an event and your organisation receiving the report?

Security leadership · Facilities leaders · Risk and audit

A perimeter is only as strong as the asset decision behind it. The building boundary is rarely the whole answer.

This control expects security perimeters to be defined and used to protect areas containing information and associated assets. The guidance ties the siting and strength of each perimeter to the security needs of what sits inside it, which means the line should follow sensitivity rather than convenience.

Why it matters: A badge reader at the front door does not protect a sensitive room separated from a public corridor by nothing more than ordinary access.

A perimeter is a risk boundary expressed in physical form.

Question for practitioners: How many security perimeters stand between the street and your most sensitive information?

Facilities leaders · Security leadership · Procurement

Physical entry is identity governance expressed in doors, badges and keys. The loading bay is usually where the model stops being elegant.

This control expects secure areas to be protected by appropriate entry controls and access points. The guidance covers the full lifecycle of physical authorisation: provision, periodic review, update and revocation, supported by protected logs of entry and exit.

The legal boundary matters here too. The guidance notes that inspection of personal belongings may be constrained by local law and regulation. A physical control can still create privacy and employment exposure where the authority to perform it, and the communication of that authority, are weak.

Why it matters: The most sophisticated access system is bypassed the moment a courier can reach a restricted corridor unescorted.

Every door is an access-control decision, including the doors labelled emergency or delivery.

Question for practitioners: When did you last test the path from the loading area to the nearest sensitive room?

Facilities leaders · Security leadership · Privacy architects

Locks protect a room. Design protects the fact that the room matters.

This control asks organisations to design and implement physical security for offices, rooms and facilities. The guidance is unusually focused on visibility, audibility and discoverability rather than on forced entry alone.

Why it matters: A protected location that publicly announces its purpose has already surrendered part of the control it paid for.

Obscurity is not the whole defence, but unnecessary disclosure is not a control strategy.

Question for practitioners: Can a visitor identify your most sensitive rooms without asking anyone?

Security leadership · Facilities leaders · DPOs and boards

Physical surveillance is a security control that must itself be secured. And because it monitors people, it must also be governed.

Introduced in the 2022 revision, this control expects premises to be continuously monitored for unauthorised physical access. The guidance recognises guards, alarms, video monitoring and physical security management systems, operated either internally or by a service provider.

Why it matters: A surveillance system can expose sensitive movement patterns while failing to detect the very event it was installed to catch.

Monitoring without governance creates a second system that needs monitoring.

Question for practitioners: Who can view your surveillance footage, and what evidence supports the retention period?

Boards · Facilities leaders · Continuity leaders

Site selection is a security decision made before the first control is installed. Location risk cannot be patched later.

This control expects protection against physical and environmental threats, whether natural, intentional or unintentional. The guidance starts before operations begin: assess the potential consequences at the site, implement safeguards, monitor how threats change and obtain specialist advice where the organisation lacks competence.

Why it matters: A control programme cannot cheaply compensate for a facility placed in a risk the organisation never examined.

Environmental resilience begins with where you chose to stand.

Question for practitioners: Which physical threat drives the largest accepted residual risk at your most critical site?

Facilities leaders · Security leadership · Operations

Secure areas usually fail through routine behaviour, not dramatic intrusion. The door works. The conduct inside it does not.

This control expects security measures for working in secure areas, applying to all personnel and to all activities that take place inside them. Entry controls decide who may come in; this control decides what authorised people may then do.

The safety dimension is equally important. Avoiding unsupervised work can reduce malicious opportunity and protect personnel at the same time. Emergency procedures should remain readily visible or accessible even in an area deliberately designed to reveal little about itself.

Why it matters: Confidentiality can be lost by a fully authorised person carrying an entirely unauthorised camera.

Authorised entry does not create authorised behaviour.

Question for practitioners: Are people ever permitted to work alone in your most sensitive areas, and what risk decision supports it?

Security leadership · Operations · Audit and compliance

Clear desk is not a housekeeping rule. It is the most visible test of whether control culture survives ordinary work.

This control expects clear desk rules for papers and removable storage media, and clear screen rules for information processing facilities. Its reach is wider than most implementations assume, covering printers, whiteboards and even notification pop-ups during presentations or screen sharing.

The value to auditors is sampling. A visible exception is cheap to observe and can indicate whether classification, handling, disposal and management enforcement genuinely operate beyond the policy document.

Why it matters: Unattended information is available to whoever arrives next, whether or not they were authorised for the building.

A clear desk is not proof of security, but a consistently unclear one is evidence of weak enforcement.

Question for practitioners: What does an unannounced out-of-hours walk say about your wider control culture?

Facilities leaders · Security leadership · Privacy architects

Where equipment sits determines who can see it, reach it and disrupt it. Placement is a preventive control.

This control expects equipment to be sited securely and protected. The guidance treats placement as a security decision with direct confidentiality and availability consequences, rather than as a facilities preference.

The control is also context-sensitive. Industrial environments may require special protective methods, and equipment processing confidential information may require protection against electromagnetic emanation. The risk attached to the information determines the design.

Why it matters: A well-configured system placed in an exposed position quietly becomes an insecure service.

Equipment location is part of information architecture.

Question for practitioners: Can sensitive information be viewed from any position you do not control?

Security leadership · Asset owners · HR leaders

Off-site assets carry the organisation’s risk without the organisation’s environment. Custody is the control that travels with them.

This control covers the protection of assets located away from the organisation’s premises, including both organisation-owned devices and privately owned devices used on its behalf. The environment changes; the accountability does not.

Where equipment moves between people or parties, the guidance calls for a chain-of-custody log and secure deletion of information that does not need to travel with the asset. That turns a handover from an administrative convenience into an accountable transfer.

Why it matters: When an asset is lost, the first unanswered question is almost always who held it last.

Protection leaves the premises only when custody evidence leaves with it.

Question for practitioners: Can you name the current custodian and approved location of every critical off-site asset?

Security leadership · Records owners · DPOs

Storage media is governed from acquisition to destruction. The risk grows when small pieces accumulate.

This control treats storage media across its full lifecycle, covering acquisition, use, transport and disposal in line with the organisation’s classification scheme and handling requirements. Media here includes paper, not only digital devices.

Why it matters: Information can remain perfectly readable long after everyone involved believes the media was forgotten.

Disposal is the final access-control decision in the media lifecycle.

Question for practitioners: Can you trace the last batch of sensitive media from inventory to verified destruction?

Facilities leaders · Continuity leaders · Boards

Utilities are security dependencies managed outside most security teams. That does not move the risk outside the management system.

This control expects information processing facilities to be protected from power failures and other disruptions caused by failures in supporting utilities. Those utilities include electricity, telecommunications, water, gas, sewage, ventilation and air conditioning.

Capacity is a business issue as much as a facilities one. Growth in processing can quietly exceed the capacity of cooling, power or communications long before anyone revisits the continuity plan.

Why it matters: The most resilient application in the estate still fails when cooling, power or connectivity does.

Information availability begins with infrastructure the application team does not operate.

Question for practitioners: Which critical utility still has one physical route into your most important site?

Facilities leaders · Network leaders · Security and audit

Cabling is the control surface almost nobody reviews until it fails. It carries both the service and the opportunity to intercept it.

This control expects cables carrying power, data or supporting information services to be protected from interception, interference and damage. It is one of the few controls where confidentiality and availability depend on a physical route nobody routinely inspects.

Why it matters: A cable can be intercepted or damaged without any logical control ever identifying the cause.

The network diagram is incomplete if it ends at the port and ignores the route.

Question for practitioners: When did someone last inspect what is physically attached to your critical cabling?

Facilities leaders · Security leadership · Procurement

Maintenance gives authorised outsiders legitimate proximity to critical equipment. It is a supplier access control in disguise.

This control expects equipment to be maintained correctly to ensure the availability, integrity and confidentiality of information. Maintenance is routinely scoped as an availability activity, which understates what the maintainer can reach.

Why it matters: The person permitted to repair a control is frequently in a position to bypass it while doing so.

Maintenance access is privileged access with tools.

Question for practitioners: Who supervises the person who takes storage-bearing equipment away for repair?

Security leadership · Asset owners · Procurement and DPOs

Deletion is an intention. Verified sanitisation is evidence.

This control expects items of equipment containing storage media to be verified before disposal or reuse, so that sensitive data and licensed software have been removed or securely overwritten. Standard deletion is not sufficient where information must be non-retrievable.

The guidance extends the control to leased premises. Access-control and surveillance systems may retain user lists, video or images, and should be considered when a lease ends or the organisation moves out.

Why it matters: Information left on reused equipment quietly becomes someone else’s asset.

Disposal is complete only when recovery is no longer a reasonable option and the evidence says so.

Question for practitioners: Can you produce sanitisation evidence for the last equipment batch you disposed of?

Security leadership · Engineering · Privacy architects · Risk and audit

The endpoint is where policy becomes behaviour.

It is also where personal use, corporate control and privacy collide.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

It is also where personal use, corporate control and privacy collide.

Question for practitioners: If a personal device holds organisational data, who owns the wipe decision?

Security leadership · Engineering · Privacy architects · Risk and audit

Privilege should be temporary, attributable and observed.

Standing administration is an unmanaged exception disguised as a role.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Standing administration is an unmanaged exception disguised as a role.

Question for practitioners: How many administrators hold permanent privilege they use only occasionally?

Security leadership · Engineering · Privacy architects · Risk and audit

Restriction is where classification becomes enforceable.

A label without enforced use restrictions is only advice.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

A label without enforced use restrictions is only advice.

Question for practitioners: Once a sensitive file leaves your environment, what still protects it?

Security leadership · Engineering · Privacy architects · Risk and audit

Source code is intellectual property, attack surface and operational authority at once.

Write access is the crown jewel.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Write access is the crown jewel.

Question for practitioners: How many people can change production code without a second pair of eyes?

Security leadership · Engineering · Privacy architects · Risk and audit

Authentication strength should follow information risk.

The login process can either resist reconnaissance or assist it.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

The login process can either resist reconnaissance or assist it.

Question for practitioners: Does the login process reveal which part of an attempted credential was correct?

Security leadership · Engineering · Privacy architects · Risk and audit

Capacity is an availability control with a security tail.

Exhaustion causes outages, and outages cause shortcuts.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Exhaustion causes outages, and outages cause shortcuts.

Question for practitioners: Is capacity planning part of the security programme or only the operations budget?

Security leadership · Engineering · Privacy architects · Risk and audit

Malware protection is layered behaviour, not one installed product.

Detection software is necessary and explicitly insufficient.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Detection software is necessary and explicitly insufficient.

Question for practitioners: Where can malware protection not be installed, and what compensates?

Security leadership · Engineering · Privacy architects · Risk and audit

Vulnerability management is an inventory problem before it is a scanning problem.

A finding becomes governance when a clock and owner are attached.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

A finding becomes governance when a clock and owner are attached.

Question for practitioners: Do you have a defined clock for critical vulnerabilities, and do you meet it?

Security leadership · Engineering · Privacy architects · Risk and audit

A secure baseline delivers assurance only while drift is visible.

Configuration is a continuous control, not a build-time event.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Configuration is a continuous control, not a build-time event.

Question for practitioners: How would you know today if production drifted from its approved baseline?

Security leadership · Engineering · Privacy architects · Risk and audit

Deletion is both a legal duty and a risk-reduction decision.

Data retained without need becomes unmanaged liability.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Data retained without need becomes unmanaged liability.

Question for practitioners: Can a cloud provider prove deletion, or only promise it?

Security leadership · Engineering · Privacy architects · Risk and audit

Pseudonymised is not anonymised.

Reversibility decides whether the information remains identifiable.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Reversibility decides whether the information remains identifiable.

Question for practitioners: Is test data anonymised, or just renamed?

Security leadership · Engineering · Privacy architects · Risk and audit

Data leakage prevention monitors people as well as information.

Deployment without governance can create the exposure it seeks to reduce.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Deployment without governance can create the exposure it seeks to reduce.

Question for practitioners: Was the leakage-prevention deployment legally reviewed before it went live?

Security leadership · Engineering · Privacy architects · Risk and audit

A backup that has never been restored is an assumption.

Copying is the activity. Restoration testing is the control.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Copying is the activity. Restoration testing is the control.

Question for practitioners: When did you last restore, rather than merely back up?

Security leadership · Engineering · Privacy architects · Risk and audit

Redundancy removes one failure point and creates another environment to secure.

A secondary facility must not become a secondary standard.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

A secondary facility must not become a secondary standard.

Question for practitioners: Is the recovery environment secured to the same standard as production?

Security leadership · Engineering · Privacy architects · Risk and audit

Logs are evidence before they are analytics.

Their integrity decides whether later reconstruction is trustworthy.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Their integrity decides whether later reconstruction is trustworthy.

Question for practitioners: Can administrators delete the records of their own activity?

Security leadership · Engineering · Privacy architects · Risk and audit

Monitoring requires a defensible model of normal.

Without a baseline, alerts become noise and analysts stop believing them.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Without a baseline, alerts become noise and analysts stop believing them.

Question for practitioners: Do analysts trust the alerts, or have they learned to ignore them?

Security leadership · Engineering · Privacy architects · Risk and audit

Time is the connective tissue of investigation.

Unsynchronised clocks weaken correlation and evidence credibility.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Unsynchronised clocks weaken correlation and evidence credibility.

Question for practitioners: If the logs disagree about time, which one does an investigator believe?

Security leadership · Engineering · Privacy architects · Risk and audit

Utility programs can bypass the controls reported to management.

They deserve stricter governance than the systems they touch.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

They deserve stricter governance than the systems they touch.

Question for practitioners: Which tools can bypass the controls reported to the board?

Security leadership · Engineering · Privacy architects · Risk and audit

Software installation is change control and supply-chain control combined.

Unsupported software is a recorded risk decision whether acknowledged or not.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Unsupported software is a recorded risk decision whether acknowledged or not.

Question for practitioners: How much of the environment runs software nobody supports?

Security leadership · Engineering · Privacy architects · Risk and audit

Network security begins with knowing what the network actually is.

Documentation accuracy is often the first control to fail.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Documentation accuracy is often the first control to fail.

Question for practitioners: How old is the most recent accurate network diagram?

Security leadership · Engineering · Privacy architects · Risk and audit

A network service is a supplier service with technical consequences.

Security features and service levels must be specified, not assumed.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Security features and service levels must be specified, not assumed.

Question for practitioners: What has the connectivity provider committed to in writing?

Security leadership · Engineering · Privacy architects · Risk and audit

Segregation limits blast radius.

A flat internal network turns one compromised endpoint into an architecture problem.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

A flat internal network turns one compromised endpoint into an architecture problem.

Question for practitioners: How far can an attacker move after compromising one ordinary endpoint?

Security leadership · Engineering · Privacy architects · Risk and audit

Web filtering is a protective rule set before it is a blocking technology.

Exceptions reveal whether the control supports business or merely obstructs it.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Exceptions reveal whether the control supports business or merely obstructs it.

Question for practitioners: What happens when someone legitimately needs a blocked resource?

Security leadership · Engineering · Privacy architects · Risk and audit

Cryptography is a key-management problem.

Algorithms rarely fail as often as ownership and lifecycle do.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Algorithms rarely fail as often as ownership and lifecycle do.

Question for practitioners: Who can access encryption keys, and what happens when that person leaves?

Security leadership · Engineering · Privacy architects · Risk and audit

Secure development is a governance rule set applied to engineering.

It is not a scanner added before release.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

It is not a scanner added before release.

Question for practitioners: Can a security gate actually stop a release?

Security leadership · Engineering · Privacy architects · Risk and audit

Application security begins before code exists.

Requirements written after launch are findings, not requirements.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Requirements written after launch are findings, not requirements.

Question for practitioners: Were the application security requirements written before or after the code?

Security leadership · Engineering · Privacy architects · Risk and audit

Architecture principles are commitments, not slogans.

Least privilege and defence in depth matter only when design decisions show them.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Least privilege and defence in depth matter only when design decisions show them.

Question for practitioners: Are architecture principles written down, or held as folklore?

Security leadership · Engineering · Privacy architects · Risk and audit

Secure coding extends to code the organisation did not write.

Third-party and open-source components are part of the attack surface.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Third-party and open-source components are part of the attack surface.

Question for practitioners: Is there an inventory of every third-party library in the product?

Security leadership · Engineering · Privacy architects · Risk and audit

Testing must show the system does what it should and nothing else.

Independent acceptance is the line between developer confidence and organisational assurance.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Independent acceptance is the line between developer confidence and organisational assurance.

Question for practitioners: Who signs that the system behaves only as intended?

Security leadership · Engineering · Privacy architects · Risk and audit

Outsourced development makes assurance contractual.

If requirements are not enforceable and tested, they are preferences.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

If requirements are not enforceable and tested, they are preferences.

Question for practitioners: Do contracts provide the right to assess the code and development process?

Security leadership · Engineering · Privacy architects · Risk and audit

Separation protects production from experimentation and test data from convenience.

One person controlling every environment defeats the boundary.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

One person controlling every environment defeats the boundary.

Question for practitioners: Can one person move code to production alone?

Security leadership · Engineering · Privacy architects · Risk and audit

Change is one of the most common causes of avoidable failure.

Emergency is a path through control, not an exemption from it.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Emergency is a path through control, not an exemption from it.

Question for practitioners: What proportion of incidents began with a change nobody assessed?

Security leadership · Engineering · Privacy architects · Risk and audit

Test environments are often low-control copies of high-value data.

Production data copied for convenience remains production risk.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Production data copied for convenience remains production risk.

Question for practitioners: How many copies of production data exist outside production?

Security leadership · Engineering · Privacy architects · Risk and audit

Assurance activity is itself a risk.

Audit access must be scoped, agreed, monitored and removed.

Technical responsibility may sit with engineering or operations, but accountability still requires a named owner, an approved position and evidence that exceptions are visible.

Why it matters: a technically capable control that cannot be traced to a decision, owner or operating record is difficult to defend under audit or after an incident.

Audit access must be scoped, agreed, monitored and removed.

Question for practitioners: Is the auditor device held to the same standard as internal devices?