Part III · Chapter 5 · Evidence · lesson 1
What would you hand them, right now, for this one?
13 min
Builds on Designed, or running? Decide for each one
Part III · Chapter 5 · Evidence · lesson 1
13 min
Builds on Designed, or running? Decide for each one
Six controls, copied off a real register, every one of them marked as running.
Now the only question this track asks, asked for the first time: for each of those, what would you put in somebody's hands this afternoon, with no preparation, no asking around, and nothing written specially?
Not what you would write. What already exists, with a date on it.
Predict
The hand-over test has one rule: name the artefact, or admit there is not one.
An artefact passes if it already exists, carries a date, and was produced by the control happening rather than written about the control. A policy is a real artefact and it speaks to design. A dashboard showing a job succeeded is a real artefact and it speaks to that job, not to the control somebody wrote down.
Two answers are honest and useful. Here is the thing, dated, from June. Or: there is nothing, and here is what I would start producing on Monday.
One answer is neither — that you could put something together. That sentence is about the next three weeks, and the question was about this afternoon.
The uncomfortable part is how ordinary the nothing is. Most registers have one or two controls where the honest answer is that nothing exists, and they are rarely the controls anybody worried about. They are the ones that felt covered because something nearby was green.
Take the one below. Decide whether it is yours, say where it has got to, and name who would notice it stopping. The block will not tell you whether that is good. It will tell you what the decision you just recorded contradicts.
Decide · backup-restore-test
A backup is a hypothesis and a restore is the experiment. Nearly every organisation has backups; a much smaller number have evidence that data came back out of one, into a working system, within a time anybody had agreed to. This control is about the second thing, and the first thing only matters because it is a precondition.
The decision
What you restore, how far you take it, and how often. A restore into a scratch environment proves the archive is readable; a restore that an application then successfully serves proves considerably more and costs considerably more. Deciding which of those you are claiming, and saying so, is the control. So is deciding what happens when the test fails, because a failed restore test during business hours is good news arriving at an inconvenient time.
Where this goes wrong
The backup job reports success and the success is monitored, which makes the whole area feel covered. Nothing in that signal speaks to whether the archive can be read, whether the schema still matches, or whether anybody holds the key, and each of those failures is silent right up until the restore that was not a test.
Does this apply to you?
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
If you marked it running, one of two things happened.
With nothing attached, the engine says the control is marked operating and has no evidence linked to it, and asks what you would hand someone who asked to see it running. That finding is this lesson in one line, generated from your own data rather than from an opinion about you.
Attach only the written schedule — what gets backed up, how far back it goes, how long a recovery is meant to take — and the engine says something sharper: everything linked evidences design rather than operation, and asks what the control produced, on a date, the last time it ran. The document is not being dismissed. It is being read for what it is, which is a statement of intent with no instance behind it.
There is a third case, and it is the one the condition on this control exists to catch. You may decide it does not apply to you. That is allowed, it is recorded, and the block then says whether its own condition agrees — and disagreeing is the more interesting outcome, because the condition knows six facts about you and you know the rest.
There is a worse case than nothing, and it looks like something.
The restore test happened. Somebody ran it in March, it worked, and the only record of it is a chat thread in a workspace on a ninety-day retention plan. In March the artefact was real. By September the period you want to speak to reaches back further than the system holding the proof.
Nothing failed and nothing was deleted on purpose. A retention setting somebody chose for cost, in a tool nobody thinks of as an evidence store, quietly set the length of the period you can speak to. Worth checking before the period opens rather than after it closes, because it is the one version of this problem that no amount of later work recovers.
Check