Describe your own organisation, and watch half the work disappear

The usual way this starts is a list. Somebody downloads a register of controls, sees ninety-odd rows, and begins at the top with a feeling of dread that is entirely rational given the size of the list.

The list is the wrong object to start from, because a large share of it is not yours to argue about. Whether a control is even a question for you is decided by a handful of facts about what your company is — not by the framework, and not by whoever wrote the register.

Six facts, in the block below. Five of them are yes-or-no and one is a number. They are deliberately dull: do you write the software you run, do you hold data belonging to your customers' customers, do you run your own machines, are there staff beyond the founders, do you depend on other companies inside your boundary, and how many people are there.

Answer them about your own organisation rather than about the organisation you are planning to be. The honest answer removes more than it adds, which is the part nobody expects.

Predict

Which of these facts, answered honestly, is most likely to make a control apply that a company would otherwise have excluded?

Choose one answer

Writing the software you runNot running your own infrastructureHolding your customers' customers' dataHaving staff beyond the founders

Lock in answer

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

Six facts about you

These decide which controls are even yours to argue about. The honest answer usually removes more than it adds.

Do you write the software you run?Do you hold data belonging to your customers' customers?Do you run your own infrastructure, not only managed services?Are there staff beyond the founders?Do you depend on other companies inside your boundary?

How many people?Save your shape

What does not line up

What your six answers now disagree with

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

Reading it back

Four things are worth looking at in what just happened, and none of them is a score, because there is not one.

What came off the list. If you do not write the software you run, the development-practice control is not a question for you. If there are no staff beyond the founders, the employment-lifecycle control is not either. These are not loopholes — they are the register doing the only honest thing available, which is to stop asking you about work that has no subject in your company.

What went on the list that you might not have expected. Not running your own infrastructure turns on the device-and-perimeter question rather than turning it off. Depending on other companies inside your boundary turns on the supplier question whether or not you have ever assessed one. Neither of those is a judgement about you; both are consequences of a fact you just recorded.

The headcount threshold. One control needs both that you write software and that there are four or more of you, because independent approval of a change requires a second person who was not the first person. At three people the honest position is that the control does not apply and the risk it addresses is still there. That gap is not a failure of the register; it is the shape of a very small company, and saying so out loud is better than pretending the control runs.

What the referee said, which was probably nothing. The panel above reads your whole workspace, and at this point in the track there is almost nothing in it — no risks, no controls marked as operating, no evidence. An empty workspace has no contradictions, and that silence is not a clean bill of anything. It is the honest output of a graph with nothing in it.

Check

Your organisation is going to start running its own infrastructure next quarter. What should the six facts say today?

Choose one answer

Record it as already true, so the register is readyRecord what is true today, and expect to change it when it changesRecord both, with a noteLeave it blank until the quarter starts

Check answer

That last point is the one the manifest flags as the condition under which this lesson stops being true: an organisation changing shape faster than its register is updated, which is most of them. The register is only as good as the day it describes, and the fix is not better software — it is somebody noticing in the same week that a fact changed.

Worth remembering

• Applicability comes before implementation: a large share of any control list is not yours to argue about, and which share is decided by a handful of facts about your organisation.
• Six facts do the work — whether you build the software, hold third-party data, run your own machines, have staff beyond the founders, depend on other companies inside the boundary, and how many people there are.
• Not running your own infrastructure turns the device-and-perimeter control on rather than off, because the compensating controls a building provided have gone and nothing replaced them.
• One control needs four or more people, because independent approval requires a second person who was not the first person; below that the honest position is that it does not apply and the risk remains.
• Record what is true today rather than what will be true next quarter, because a control in scope on an untrue fact cannot have operated.
• An empty workspace produces no contradictions, and that silence is the honest output of a graph with nothing in it rather than a clean result.