Draw the boundary you would draw today, knowing what it costs

Your first boundary was drawn by somebody who did not know three things.

They did not know what a control costs to run for a year. They did not know which controls produce an artefact as a by-product of work that was happening anyway and which ones need somebody to go and make one. And they did not know which questions actually get asked, as opposed to which ones the questionnaire contains.

You know all three now. This is the lesson where that gets spent.

Predict

Four changes between a first boundary and a second. Which one is most likely to reduce next year's hours without costing you a conversation with a buyer?

Choose one answer

Taking the staging environment out of the line, since it holds no customer dataExcluding the contractors, since they are not employeesExcluding the second region, since the first one is the main deploymentCarving out the newer product and keeping the original one in

Lock in answer

Start with the six facts, because they moved too

Before the sentence, the shape. The six facts about your organisation decide which controls are even yours to argue about, and in a first year the honest answers remove more than they add.

In a second year they usually add. You had no staff beyond the founders and now you have eleven. You ran everything on managed services and now there is a cluster somebody operates. You depended on nobody and now three companies sit inside your boundary. Each of those flips a condition, and each flip makes controls applicable that were legitimately excluded twelve months ago with reasons that were true at the time.

Re-answer them as they are today.

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

Six facts about you

These decide which controls are even yours to argue about. The honest answer usually removes more than it adds.

Do you write the software you run?Do you hold data belonging to your customers' customers?Do you run your own infrastructure, not only managed services?Are there staff beyond the founders?Do you depend on other companies inside your boundary?

How many people?Save your shape

Now the line

Write the boundary you would draw today, knowing what the work costs. Then hold it against the three tests above, in that order, and keep the version that survives.

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

What is inside the line?

One or two sentences, in your own words. The test is whether you would read it out to a customer.

Save the boundary

Before you narrow anything: find the commitment

This is where the lesson stops being yours to decide, and it is worth checking before the sentence is final rather than after.

If your first boundary went into a customer contract — a security schedule, a signed questionnaire, a data processing agreement naming the systems in scope — then narrowing it is not a scoping decision. It is a contractual conversation, with a different counterparty, a different timeline and somebody in legal involved. The sequence that works is: find out what you have already promised, then draw the line, then say which part of the difference needs a conversation.

The sequence that does not work is drawing the better line first and discovering the commitment in eleven months, when a buyer reads last year's schedule back to you. That failure is not detectable by anything in this workspace, because the promise is in a document the workspace has never seen.

What does not line up

What the line you just drew now disagrees with

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

Why that list is the whole list

Everywhere else in this track the referee has been narrowed to one part of the graph. Here it is not, and that is deliberate.

A boundary decision is the only one whose consequences land in every part at once. Admit a system and the controls covering it owe evidence for every day it has been inside. Admit people and half the controls that are things humans do on a schedule acquire a larger population. Flip one of the six facts and controls you excluded with a good reason become controls you have excluded with a reason that expired.

So read the list above as the price of the line rather than as a to-do list. Some of those contradictions you will close with work. Some you will close by moving the line back out. And some are the honest cost of a narrower boundary that you would defend anyway, which is a decision rather than a defect — the engine has no way to tell those three apart, and you do.

Check

You redraw the line narrower, and the version in last year's signed security schedule is wider. What is the honest position while the contract conversation is still open?

Choose one answer

Operate to the narrower line and put the narrower one in the next reportOperate to the wider line until the contract changes, and say which line each document describesKeep both boundaries in the register and pick per audienceAsk the customer to agree to the narrower line before doing anything else

Check answer

Worth remembering

• The second boundary is usually more specific rather than smaller.
• A first boundary was drawn without knowing per-control hours, which evidence exists anyway, or which questions get asked.
• The six facts about the organisation move too, and in a second year they usually add controls rather than remove them.
• An exclusion with a reason is a decision; without one, somebody else characterises it.
• A line you cannot read out to the customer who asked the hardest question is not finished.
• Find what you have already promised in writing before narrowing anything.
• A boundary decision is the only one whose consequences land in every part of the register at once.