“Every assessment starts from scratch and evidence is hard to find.”
When control mapping, evidence collection, applicability decisions, findings and reporting are organized consistently, each assessment builds on the last instead of starting again.
Different assessors reach comparable conclusions using the same criteria.
Evidence collected once can support several requirements and reviews.
Every finding can be traced to a requirement, a control and evidence.
Results can be compared over time and across sites.
A sequence that can be adapted to your environment and scope.
Choose the framework and confirm applicable requirements.
Link requirements to the controls that address them.
Attach or reference evidence for each control.
Record findings where controls or evidence fall short.
Summarize status and track corrective actions.
A company assesses two sites in successive years using different spreadsheets, so the results cannot be compared. A common control set, rating scale and evidence index are introduced. The following year both sites are reassessed in the same structure and progress is visible at a glance.
Against an agreed reference, using defined rating criteria, with evidence for each conclusion and an explicit note of operational constraints and compensating measures.
A recorded judgment on whether a requirement applies to a given system or site, and why. Recording it avoids repeating the debate in every assessment.
From the blog
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the articleManufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the articleSegmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the articleDescribe where you are today and we'll suggest a practical way forward.