Does this one apply to you, and say why out loud

Forty people. No office — the lease went in 2021 and nobody has missed it. Everything runs on managed hosting; there is no rack anywhere with your name on it. A control about physical security turns up on a list somebody sent you.

Commit to an answer before you read the control.

Predict

Forty people, no premises, no infrastructure of your own. Does a control about physical security apply to you?

Choose one answer

No — there is nothing physical to secure, so the control is inapplicableNo — it belongs to the hosting provider now, and their own report covers itYes — and the absence of premises is the reason rather than the exemptionIt depends on what the standard says about remote work

Lock in answer

The procedure is two columns and nothing else. On the left, the facts about your own organisation: whether you write the software you run, whether you hold data belonging to your customers' customers, whether you run infrastructure rather than consuming managed services, whether there are staff beyond the founders, whether other companies sit inside your delivery, and how many of you there are. On the right, the control's own condition — the shape of organisation it is about.

The answer is the intersection, and the answer has three possible values, not two. Applies, with a reason. Does not apply, with a reason that is about your shape rather than about your inconvenience. And not decided, which is the honest default and the one most registers quietly skip past by inheriting somebody's template.

What gets read, months later by somebody who was not there, is the reason. The status is a word; the reason is the only part that tells the next person whether your decision still holds. Write it as though they will ask you about it, because that is the situation in which it will be read.

Decide · physical-without-premises

Physical security when there is no building

A distributed company with no office has not escaped physical risk; it has distributed it into forty homes, cafes and airports, and lost the one place where a badge reader could have helped. The devices are the perimeter now, and the control is about what protects data on a machine somebody is carrying.

The decision

What happens to the data on a device nobody can go and collect. Full disk encryption with a key the holder does not control, a remote wipe path that works without the device cooperating, a screen lock short enough to matter — and the harder decision, what the company is willing to do to a personal device, which is a negotiation rather than a setting.

Where this goes wrong

This control gets excluded on the grounds that there are no premises, which reads as reasonable and is backwards: the absence of premises is the reason it applies, because the compensating controls a building provides have gone and nothing replaced them. The exclusion is usually written once and inherited by everyone who reads the register afterwards.

Does this apply to you?

Yes, it is ours to doNo, and I can say why

Record this decisionDecide whether it applies first.

Reading it back

Two things are worth noticing about what you just did.

The first is that the decision had a reason attached, and the reason was about your organisation. That is a different object from the same word with no reason behind it. Not applicable on its own is a position nobody can evaluate, including you in eleven months. Not applicable, because no employee holds data on a device we do not manage, and here is the list is a decision somebody can check, agree with, or find out of date.

The second is that this control excludes some shapes of organisation genuinely rather than decoratively. A solo operator with no staff is outside its condition. A company running its own racks is outside it too, for the opposite reason: the premises control proper is the relevant one there, and this one is about the case where the premises have gone. An applicability rule that cannot be false for anybody is not a rule, it is a list — and most published control lists are lists.

What does not line up

What this decision now disagrees with

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

The referee above read your decision against everything else in your workspace. It is not telling you whether the decision was right; it has no way to know that and neither does anything else you could install. What it can do with no judgement at all is notice that two things you wrote cannot both be true — a control marked as running with no owner, a control excluded on grounds your own recorded shape contradicts, a control whose owner sits in a team your boundary leaves outside.

If it found nothing, that is a statement about your workspace rather than about your organisation. An almost-empty register has no contradictions in it, which is the least informative state it can be in.

Worth remembering

• Applicability is the intersection of your own recorded shape and the control's condition, decided before any clause is looked up.
• There are three answers, not two: applies, does not apply, and not decided — and the third is the honest default.
• The status is a word; the reason is the part that gets read, and the only part that tells a later reader whether the decision still holds.
• The absence of premises is a reason a physical control applies rather than a reason it does not, because the compensating controls a building provided have gone and the devices are now the perimeter.
• A condition that cannot be false for any organisation is not a rule but a list, and a reader handed a list stops deciding.
• The referee can say that two things you wrote disagree. Nothing available to you can say whether a decision was right.