“Audits mean weeks of searching for documents and surprise findings.”
Maintaining traceable evidence, control results, findings and remediation records supports internal reviews and preparation for applicable external assessments.
Gaps are found internally before an assessor finds them.
Teams are not pulled away from operations to search for documents.
Consistent records show a managed program, not a one-off effort.
Knowledge survives staff changes when evidence is organized.
A sequence that can be adapted to your environment and scope.
Know what evidence exists and who owns it.
Set review dates so evidence stays current.
Run internal checks against the requirements.
Track corrective actions to closure.
Prepare a clear status summary for reviewers.
Before an external review, a site discovers that its remote access procedure exists but no session records were kept. Because the internal check happened two months early, logging is enabled and a period of records is available by the time of the review.
Commonly policies and procedures, asset inventories, architecture drawings, access reviews, remote access records, patch and backup records, change records and incident response exercises.
From the blog
Regulation7 min
National NIS2 laws are now being enforced. Here is what energy, water, transport and manufacturing operators should be able to show for their OT environments.
Read the article
Regulation6 min
Manufacturers must now report actively exploited vulnerabilities and severe incidents. Asset owners should expect more advisories, and suppliers need a working process.
Read the article
Architecture8 min
Segmentation diagrams often look perfect and behave very differently. A practical method for zones and conduits that match how your site really works.
Read the articleDescribe where you are today and we'll suggest a practical way forward.