Work backwards from the date they asked for

The message is four lines long and somebody in procurement sent it. They want your report before the contract renews. The renewal is twelve months from today.

Nobody has mentioned a control. Nobody has mentioned a firewall, a policy or a password. The only object in the email is a date.

So: if you said yes this afternoon, when would the work actually have to have begun? Pick a date before you read on. Out loud, or at least on purpose.

Predict

A buyer needs your report twelve months from today. When does the work have to start?

Choose one answer

Some time next spring — there is a whole yearAbout three months from now, to be safeToday, this afternoon, before the email goes coldIt was about three months ago

Lock in answer

The model below runs that subtraction. Today is an input rather than the system clock, so the answer is the same every time anybody opens it. The buyer's date is twelve months out. Six weeks of fieldwork, which is unremarkable. Eight weeks of work before the period opens, which is optimistic.

Window countdown

≈ Hypothetical model, not a forecast

Works backwards from a target report date to the day the observation window must already have opened, and the day work must have started for it to open on time. It answers when you must start, and it will never answer whether you are ready — no arrangement of dates can tell you that.

It assumes

• Today is the 2nd of October 2026, declared rather than read from a clock.
• Six weeks between the period closing and the report existing, which is a short estimate rather than a promise.
• Eight weeks of work landing before the period opens, which assumes somebody is already free to do it.
• Weekends, holidays and the December freeze all count as ordinary days here.
• Nothing slips: no reviewer is on leave, and no evidence turns out to be missing.

It ignores

• Whether the controls work, whether evidence exists, or whether anybody is ready — this is a calendar, and a date cannot answer any of those
• Scheduling reality: reviewer availability, fieldwork slipping, the report taking longer to write than to earn
• Weekends and holidays, which make every stretch here shorter in working days than it looks
• Whether a shorter window would be accepted, which is a negotiation and not arithmetic
• Evidence that has to be collected from before the window opens, which moves the start date earlier again
• The possibility of a window that has already opened, where the start date is in the past and the arithmetic says so without saying what to do about it

Hold the dates and both work legs still. Shorten the period until the day work must start is no longer behind you, and stop at the longest period for which that is true.

Observation window12

Calendar months the window must cover before it closes.

Day the window must open, numbered from 1970-01-01

20,686

Window opens — year

2,026

Window opens — month

8

Window opens — day

21

Days from today until the window must open

-42

Work must start by — year

2,026

Work must start by — month

6

Work must start by — day

26

Days from today until work must start

-98

Days by which that start date has already passed

98

The start date needed for this target is in the past

1

Length of the window in days, as the calendar falls

365

Days from the start date to the report date

463

• Days until the period must open
• Days until work must start

◷ Not there yet — keep moving the controls.

A twelve-month period, closing six weeks before the report, means the period closes on the 21st of August 2027 and therefore opened on the 21st of August 2026. That is six weeks in the past.

Take eight weeks off that for the work that has to land first, and the start date is the 26th of June 2026 — ninety-eight days before the email arrived. The buyer's year does not contain a year of room. It contains about eight months of room, and that is the challenge's answer: at eight months the start date moves back into the future, and the target stops being something the calendar rules out on its own.

Notice what the two lines do. They are not slopes anybody can argue with. Every month added to the period pushes both dates back by a month, exactly, and no amount of effort applied in October changes where the 21st of August was.

Why the fourth date is the one that hurts

The first three dates are negotiable in the way dates usually are. A reviewer can sometimes start a week earlier; a report can be chased. The fourth one is a different animal, because it is the only one nobody can buy their way past afterwards.

A period describes a stretch of time that has already happened. If a control was not running in August, there is no version of September in which it was. Money shortens fieldwork and chases a report. Nothing fixes August.

Check

The buyer says they would take a three-month period instead of twelve. What has that actually bought you?

Choose one answer

Nothing, since the report date has not movedNine months of calendar at the front, which puts the start date back in the futureA quarter of the work, since the period is a quarter as longEnough slack that the date stops being the problem

Check answer

That is the thesis of this whole subject, and it sits in the first lesson because everything after it is a refinement: this is a calendar problem long before it is a security problem. The security work is real, and most of it is work worth doing anyway. The calendar is the part that decides whether any of it can be described by a date somebody has already written into a contract.

›Why nobody runs this subtraction before saying yesOptional

Because the email does not look like it contains a calculation.

It names a document and a date, both of which read as procurement. The person who receives it is usually the person who can see the whole company, which means they are also the person with the least time, and the reasonable response to a four-line email is a four-line reply.

There is a quieter reason too. The subtraction produces an answer that is awkward to say out loud, and a date already in the past is not a finding anybody wants to carry into a meeting. So the honest version arrives late, from whoever eventually opens a calendar, and by then the sunk cost is an argument rather than a number.

The way out is unglamorous: run the subtraction in the reply. A date behind you is a negotiation if it is raised in week one and a mess if it surfaces in month eight, and the difference between those two is only who mentioned it first.

Worth remembering

• A buyer's request contains one date; the calculation that answers it needs four — the report, the close of the period, the opening of the period, and the day work has to begin.
• Work backwards, never forwards: report date minus fieldwork gives the closing date, minus the period length gives the opening date, minus the preparatory work gives the start date.
• At a twelve-month period, six weeks of fieldwork and eight weeks of preparation, a deadline twelve months out means the start date was about ninety-eight days ago.
• The period length is the only leg that moves in whole months, which makes it the largest lever in the arithmetic by a wide margin.
• Money shortens fieldwork and chases a report. Nothing retrospectively makes a control have run in a month when it did not.
• This is a calendar problem before it is a security problem, and the calendar is the part nobody is told about.