Shawn's Assessment Notes · Operational Reality
Documentation Is Not the Control
Policies and procedures establish intent. Assessors still need to determine whether the organization operates that way in practice. The gap between documented process and daily behavior is where assessment risk often appears.
What the assessor sees
Build an evidence path that can be followed and defended.
- Treat policies as the beginning of the evidence chain, not the end.
- Validate procedures against actual system configuration and user behavior.
- Look for inconsistencies between the SSP, diagrams, inventories, tickets, and interviews.
- Correct operational drift before assessment day.