Part II · Chapter 2 · The Boundary · lesson 2

Count what is inside the line before you draw it

13 min

A company to count. Orrery, 210 people on the payroll and 28 contractors on top. One hundred and forty systems on the asset list, of which 31 hold customer data. Twenty-four people can reach production. Seventeen other companies sit somewhere inside the delivery of the product.

That is four categories, each with a number against it, and nothing else. No controls yet, no frameworks, no opinions. The question in front of you is where to draw a line through those numbers.

Predict

Take the narrowest boundary anybody would stand behind: the systems holding customer data, and the people who can reach production. Nothing else. Roughly how much of the company is inside that line?

About a seventh of itAbout a thirdAbout halfNearly all of it — a boundary is mostly a formality

A boundary is four counts, not a paragraph.

Systems — the things that run. The useful subset is the ones that hold or touch customer data, because that subset is defensible in a sentence.

People — the ones who can reach what is inside. The useful subset is production access, for the same reason.

Contractors — people who are not on the headcount and are on the access list. They belong to the people count or to nobody.

Other companies — the suppliers inside your delivery. They belong to the systems count or to nobody.

Writing the four numbers down is the entire method. Everything after it is arguing about where the line goes, which is an argument you cannot have until the numbers exist.

The model holds those four counts and one control for where the line falls. The line has four positions and each one adds exactly one category to the one below it, so a notch is a defined step rather than a gesture. For now, leave the line at its narrowest and move only the counts.

Scope arithmetic

Hypothetical model, not a forecast

Counts the systems and people inside a stated certification boundary, the ones left outside it, and how far the count moves when the boundary shifts by one category.

It assumes

The four counts are an inventory somebody produced, not a measurement — most companies discover theirs is wrong while doing this.
Contractors are counted as people and other companies as systems, never as both.
A system holding customer data is one of the systems, and the count is clamped so it cannot exceed the total.
A person with production access is one of the people, and that count is clamped the same way.
Everything there is to put inside or outside is systems plus other companies plus people plus contractors, which assumes the first two lists do not already contain the last two. In practice neither list does.

It ignores

Whether the boundary chosen is defensible, which is a judgement and the whole argument
Nested subprocessors — the ones your subprocessors use, which are in scope for your customers whatever your boundary says
Shadow systems nobody put on the list, which are out of scope by omission rather than by decision
Data flows: a system holding no customer data but able to reach one that does
Effort, which does not scale with the count — one noisy system can cost more than forty quiet ones
That the boundary a customer assumes is almost always wider than the one certified

At this position of the line, four of the six counts do nothing at all. Find them by moving each one on its own and watching the count inside the line. Then use the two that do work to take the count inside the line past 100.

Systems140

Systems holding customer data31

People210

People with production access24

Contractors28

Subprocessors17

Systems inside the boundary: 31
People inside the boundary: 24
Systems and people inside the boundary: 55
Systems and people left outside it: 340
Boundary tier: 0 narrowest, 3 everything: 0
Systems and people one category wider would add: 28
The count one category wider: 83
Systems and people one category narrower would drop: 0
The count one category narrower: 55
Everything there is to put inside or outside: 395
Share of the whole estate inside the boundary: 0.139

Systems inside
People inside

Four stacked columns rising left to right: three short ones close together, then a fourth almost four times the height of the third.
Where the line falls: 0 narrowest, 3 everything	Systems inside	People inside
0	31	24
1	31	52
2	48	52
3	157	238

Not there yet — keep moving the controls.

What the counting told you

Fifty-five things inside the line and three hundred and forty outside it. The share inside is the number a buyer reading your certificate would want and never gets, because no document in either framework reports it.

Four of the six counts were inert. The total number of systems did nothing; so did the total number of people, the contractors and the other companies. At the narrowest line the only two counts that moved anything were the two subsets — systems holding customer data, people with production access.

That is worth sitting with, because it inverts the usual instinct. Your boundary at its narrowest is not sensitive to how big your company is. It is sensitive to how good your filters are, and a filter is a sentence somebody wrote. Change systems holding customer data from 31 to 86 and you have doubled the count inside the line without adding one machine to the estate.

Which is also the first place this goes wrong in real life: the subset count is usually guessed, upward, by somebody being careful. Being careful about the filter is the most expensive form of caution available here.

Check

A colleague says your narrow boundary is too narrow and proposes widening the filter: not systems holding customer data, but systems that could reach a system holding customer data. What has that done to the four counts?

Nothing to the counts — it is the same systems described more carefullyIt replaces a count somebody can produce with a count that depends on network and identity facts nobody has written downIt moves the line one notch widerIt reduces the count, because reaching is narrower than holding

The counts the model deliberately will not takeOptional

Three things are missing from the four categories, and each is missing for a different reason.

Nested suppliers — the companies your suppliers use. They are inside your boundary as far as your customers are concerned, whatever your sentence says, and there is no count of them anywhere because nobody publishes one.

Systems nobody put on the list. The free tool somebody connected to production with an API token has no invoice and therefore no row in the asset inventory. It is outside your boundary by omission rather than by decision, and those two are not the same thing to defend.

Effort. The count is systems and people, and effort does not scale with the count. One noisy legacy system with three owners and no logging can cost more hours than forty quiet managed services. The count is the right first number and the wrong last one.

Worth remembering

A boundary is four counts — systems, people, contractors, other companies — and the paragraph is a rendering of those counts rather than a substitute for them.
At the narrowest line the totals are inert; only the two subset filters move the count, so the cost is set by how the filter is worded rather than by how large the company is.
Fifty-five of three hundred and ninety-five, at ordinary numbers for a company of this shape: the narrow boundary leaves most of the company outside, by design.
The share of the estate inside the line is the number a buyer wants and no document in either framework reports.
A filter nobody can evaluate — systems that could reach customer data — is an undefined quantifier wearing the clothes of precision.
The count is the right first number and the wrong last one, because effort does not scale with it.