Part II · Chapter 4 · What a control is · lesson 7
One thing you do, cited by four different clauses
14 min
Builds on One boundary, written twice for two different readers
Part II · Chapter 4 · What a control is · lesson 7
14 min
Builds on One boundary, written twice for two different readers
One activity: somebody with the standing to say no looks at who can reach a system, every quarter, and confirms each entry still has a reason behind it.
Five things cite it. Two identifiers on the management-system side — the ones to look up are A.5.18 and A.5.15. Two on the criteria side, CC6.2 and CC6.3. And a sentence in a customer contract that commits you to reviewing access to their data at least quarterly, which nobody in the compliance conversation knows about because it lives in the sales folder.
One quarterly review, five citations. The temptation is to read that as efficiency.
Predict
Crosswalks are presented as translation: this identifier equals that one. Translation is the wrong metaphor, because the two documents are not saying the same thing in different languages.
Mapping one of your controls to several citations is three steps, and only the first is clerical.
Find the citations. Clerical, and the easy part.
Find what each one wants differently. Cadence, independence of the reviewer, whether the records have to be dated, whether absence is visible. This is the analysis.
Build to the union. The control is then specified by the strictest element of each, which is a design nobody would have arrived at from one framework alone — and the contract is often the strictest of the lot.
Before reading what the five want differently, decide about it. The control below is the one with five pointers at it, and the decision you record is yours rather than the mapping's.
Decide · access-recertification
Access accumulates and nothing in the ordinary course of work takes it away again. People pick up permissions for a migration, a launch or a one-off favour, and the permission outlives the reason. This control is the recurring moment where somebody with the standing to say no looks at the list and confirms each entry still has a reason behind it.
The decision
Who reviews, on what cycle, and what a review is allowed to conclude. The reviewer who knows what a role grants is usually not the reviewer who knows what the person does, so either the review happens twice with two different questions or it happens once and answers neither. Picking a cadence is the easy half; deciding that a reviewer may remove access without asking the holder is the half that makes it work.
Where this goes wrong
The first list produced is usually correct, which makes the whole exercise feel like paperwork and lets the cadence slip. Nothing breaks in the meantime — every stale permission works exactly as granted — so the decay is invisible until a departed colleague's account turns up in a sample, long after the quarter where removing it would have been easy.
Does this apply to you?
The identifiers were listed above and what each one makes of the same activity is where the work is.
Cadence stops being yours. On the management-system side, a review process that demonstrably exists and is overseen internally can be in reasonable shape even if one quarter ran late. Under an opinion covering a period, the cadence itself becomes the control: four reviews are a population, and three of them is a gap in a specific quarter with a date attached. The same four reviews, the same organisation, two different readings.
Removal becomes an event rather than a sweep. One of the criteria identifiers treats modification and removal of access as things that happen and get tested individually, which rewards a ticketed revocation trail. The lifecycle framing treats the periodic sweep as the main event and gives little credit for the tickets. A control designed for one produces thin evidence for the other.
Independence may or may not be wanted. This is the condition that breaks the whole frame: if one of the five wants the review performed by somebody independent of the system being reviewed, and the others are indifferent, then your single control answers four citations and not the fifth — and the person who performs it is exactly the person it cannot be. Nothing in a mapping spreadsheet surfaces that, because the columns are topics and the problem is in who holds the pen.
The contract outranks both. It is the one with a number in it, the one you agreed to, and the only one where falling short is a breach of something you signed. In practice it is also the one left out of the mapping, because the mapping was built from the two frameworks and nobody asked the sales team.
Look at what you recorded against the control and check it against those four divergences.
If you marked it running, the claim is now specific: instances exist, inside the period, at the cadence the strictest of your citations expects. Count them. A quarterly commitment and two dated reviews is a fact about your period, and it is better to hold that fact now than to meet it in a sample request.
If you named an owner, check whether that person is inside the system being reviewed. That is the independence question in its concrete form, and it is the most common place where a control that maps cleanly to four identifiers stops answering one of them.
Check
The crosswalks sold in this market are complete, tidy, and almost entirely equivalence. They tell you that access review appears in both documents, which you could have guessed, and they are silent on the four divergences above, which are the reason the mapping is worth doing.
There is a second problem, which is why this course's own crosswalk is deliberately short. A complete ordered table of one standard's identifiers against another's reproduces the selection and arrangement of licensed documents, however original each cell is. The useful version is small, cites identifiers only, and spends its words on the gaps.
So the honest advice is to build your own, for the controls you actually run, and to write the divergence column first. If the divergence column is empty for an edge, the edge was not worth drawing.