WORKED EXAMPLE · SECURITY AND COMPLIANCE
An audit request answered from running systems
Security questionnaires answered from a control register and an evidence pack collected from systems that already run.
THE SITUATION
The company shape
A software company's larger customers send security questionnaires and audit requests. Each one is answered with screenshots and messages gathered by hand, and each takes the same people away from their work again.
Access is granted by whoever has admin rights, one supplier tool is reached through a shared admin account, and the company's legal team has a list of requirements it wants evidenced.
DISCOVERY
Weeks 1 to 2
We would agree the boundary: the systems, the suppliers and the requirement list from the client's legal team. The interpretation of the obligations stays with them.
We would inspect access, logs, change records, incidents and restore tests against that list.
We would write the control register with a status per requirement, separating controls that do not operate from controls whose records are simply not collected.
BUILD
Weeks 3 to 6
We would build the access matrix for the in-scope systems and end the shared account, with named identities in its place.
A collection workflow would pull records from the identity provider, the ticketing tool and the cloud logs on a schedule.
Each requirement would be linked to its source, owner and covered period in an evidence index.
We would assemble a dated evidence pack from what already exists and a gap plan with owners and dates for what does not.
AT THE END
What the client would hold
Access and identity
An access matrix, configured controls and an identity operations runbook.
Audit evidence
An evidence register, collection workflow and audit request index.
The evidence pack
An indexed evidence pack, a source register and a gap log.
LIMITS
What we would have said no to
Legal interpretation
Which obligations apply is the client's legal decision. We build and evidence the controls that answer the list they give us.
A promised pass
An auditor or a customer makes that decision. We make the evidence complete and inspectable.
Policies for controls that do not run
Writing a policy for a control that does not operate would make the gap harder to see, not smaller.
Backfilled evidence
Periods with no records stay marked as periods with no records.
Bring your own situation
Describe what you run and where it hurts. We reply with how the first two weeks of security and compliance work would look for you.