The smaller register you will actually keep

Three years on, a register of eleven controls looks like this. Three ran every time without anybody chasing. Five ran because one person chased them. Three stopped, at different points, for different reasons, and in each case the gap was found months later.

That is not a failure. That is the ordinary outcome, repeated across a great many organisations, and it has a consequence nobody puts on a slide: a register nobody sustains stops being true within a year, and goes on describing a company that does not exist. The document gets more wrong the longer it is left, while looking exactly as it did on the day it was right.

So this last lesson is about subtraction.

Predict

You want a register a real organisation sustains for three years. Which test, applied to each control, actually predicts which ones survive?

Choose one answer

Keep the ones that address your most serious risksKeep the ones somebody outside the register would notice failingKeep the ones with the lowest recurring costKeep the ones cited by identifiers in both frameworks

Lock in answer

Three questions per control, then one of three outcomes

Take each control in your register and ask:

Would anybody outside this document notice it failing? Name them, and name how long it takes. If the answer is the next audit, write that.

Does its artefact come out of work that was happening anyway? A ticket with an approver, a pipeline log, a signed export produced by the review itself. If somebody has to go and make the artefact, the artefact is a second control.

Is the owner's share of it inside what they actually have? You priced one of these in the sixth lesson. Thirteen and a half person-days was one control, and the owner had been given a day a month.

Three noes is not an instruction to delete anything. It is a control that needs one of three outcomes, and only one of them makes the register smaller.

Give it a detector. Change the design so failure produces a consequence somebody feels — the access review that removes access rather than listing it, the alert that pages a person rather than filling a dashboard. Keeps the control, costs something real, and is the best outcome where it is available.

Redesign so the evidence is a by-product. Keeps the control and cuts its hours, which is the only free move in this subject and is available far less often than people hope.

Cut it, and accept the risk with a name on it. This is the one that shrinks the register, and the name is the whole price. A control dropped quietly is a register that lies. A control dropped with a named person accepting the risk it addressed is a decision somebody made, and that sentence is the difference between the two registers in the Concept above.

Now cut yours. All of it is on one screen for the first and last time: the line, your shape, the period, the risks and what you could hand over. Remove what you would not sustain, and put the risk back in where you removed the control.

Your own register

Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.

What is inside the line?

One or two sentences, in your own words. The test is whether you would read it out to a customer.

Save the boundary

Six facts about you

These decide which controls are even yours to argue about. The honest answer usually removes more than it adds.

Do you write the software you run?Do you hold data belonging to your customers' customers?Do you run your own infrastructure, not only managed services?Are there staff beyond the founders?Do you depend on other companies inside your boundary?

How many people?Save your shape

The period you are claiming

Everything in here is measured against these two dates. Typed as year-month-day, so the same thing is stored whatever your browser thinks the date format is.

Opens

Closes

two dates, the second after the first

Save the period

What could go wrong

A sentence with a victim in it, not a category. There is no score field here and there is nowhere to put one: the two bands are never multiplied.

How often?

Once a year or so

How bad?

A customer notices

What will you do about it?

Reduce itAccept itHand it overStop doing it

Add it

What you could hand over

Only what already exists, with a date on it. A policy is real evidence of design and no evidence at all of operation, which is why that is the second question.

What does it show?

It is designedIt ran

How often?onceon-changemonthlyquarterlyannualcontinuous

Most recent one

Add it

What does not line up

What the cuts broke

Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.

These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.

Reading the damage

Some of what is in that list is the cut done properly and some of it is the cut done badly, and the engine cannot tell them apart. You can.

A risk you now accept, with a name on it, is not damage. The form made you enter the name before it would save, which is deliberate: it is the most common real finding in this field and the only one with a one-word fix. That row is the cut working.

A risk still marked for reduction with nothing doing the reducing is damage. You removed the control and left the intention. That row says you plan to do something about it, which is now false, and false is worse than accepted.

A control still in place that no risk of yours names is a question rather than a verdict. Sometimes the honest answer is that a contract names it, or a platform you do not operate provides it, and the engine has no field for either. Sometimes the honest answer is that it was on a list.

An artefact attached to nothing is the folder from track 4, arriving at the end of the subject to make the same point: evidence collected for a reason nobody wrote down is evidence of nothing in particular.

And the count itself goes up as you fill this in honestly. It is not a score and there is nowhere in this subject that a score could live. A number somebody has deliberately made larger cannot be screenshotted and sent to a customer as a claim, which is the one design decision in the whole product that is doing real work.

Where sustainability stops being the criterion

One case overrides everything above, and it is the condition this lesson runs out at.

If a customer contract names a control explicitly — a frequency, a scan, a notification window, a specific review — then sustainability is not the test any more. You committed to it, so the options are to resource it properly or to renegotiate, and cutting it because nobody would notice is the one option that is not available. Nobody would notice is exactly the problem: the counterparty who would notice is reading a document rather than watching your queues, and they will notice at renewal.

So the order is the same as the previous lesson. Find what you have promised in writing. Then cut what is left.

Check

You cut four controls and accepted the four risks behind them, each with a named person. What have you actually changed about your position?

Choose one answer

You have less work and the same security postureYou have less work, more risk, and four people who know which risk is theirsYou have a register that is more likely to survive an examinationYou have traded coverage for honesty, which is roughly neutral

Check answer

What you can do now

Not a verdict, because there is not one available. Nothing in this subject can tell you whether you are compliant, and nothing in it was ever going to — the only honest grader is an auditor, and an auditor cannot be simulated by a referee that reads a graph.

What is available is a list of decisions you could not have made eight tracks ago.

You can say what is inside your line, and why each exclusion is there, in a sentence you would read out to a customer. You can say what one control costs you for a year in person-days, and which person is carrying it. You can say what a clean sample did and did not rule out, using the sentence that is actually correct. You can name the three controls of yours most likely to stop, the date each artefact stops speaking, and what would tell you. And you can say which risks you are not treating, with the name of the person who said so.

None of that is a certificate. It is the set of things that the people who hold certificates turn out not to have, in the second year, when it matters — and it is a better place to finish than a page telling you that you are finished.

Worth remembering

• A register nobody sustains stops being true within a year and keeps describing a company that no longer exists.
• What predicts survival is whether somebody outside the register would notice a failure, not importance or cost.
• Cutting a control leaves a risk behind: give it a detector, redesign it cheaper, or accept it with a name on it.
• Only accepting the risk makes the register smaller, and the name is the price.
• A risk left marked for reduction with no control is worse than a risk accepted, because it is false rather than uncomfortable.
• Where a contract names a control, sustainability is not the test: resource it or renegotiate it.
• The open-contradiction count rises as you get more honest, which is why it is not a score.
• There is no verdict here, and there was never going to be one; what you have instead is a set of decisions you can now make.