Three sentences, from three engagements, that each sounded fine when they were said.
“IT says it’s patched.” A manufacturing group’s board paper, describing the evidence that twenty plants were applying security updates.
A screenshot of a document’s cover page, sent by a card-payment processor as proof that a review happened every quarter.
“We can consider that no data has been affected.” A manufacturer’s first letter to its customers, two days into a ransomware incident, before any forensic work had been done.
None of them was a lie. All three were assertions, and all three failed the moment someone with a reason to check asked for the evidence.
Who asks, and what they ask for
A QSA asks for evidence because the standard makes it the assessor’s job to see the control operate, not to hear that it does. The rule we wrote into one processor’s post-assessment notes, and we stand by it: if we could not review the evidence, the requirement is not in place. Not “probably in place”, not “in place pending documentation”. Not in place.
A customer asks for evidence because your incident is now their risk. After the ransomware attack, the group’s largest customers sent variations of the same five questions. Was our data on your systems affected? Where did the intrusion come in, and which controls failed? Who was patient zero? Which malware, and send us the indicators. And give us a statement from a third party that your environment is clean. Not one of those questions can be answered with reassurance. Each needs a date, a file hash, a diagram or a signature.
A regulator asks for evidence because it has to defend its own decision to let you operate. A payments company preparing for its banking regulator’s scrutiny does not need forty policies. It needs the policies it can prove it follows, and a record of each one being followed.
What people get wrong
They confuse existence with operation. A patching policy exists. A review procedure exists. The question is whether it ran last quarter, who ran it, and what came out. One review record is a sample of one. Recurrence is shown by several dated records, ideally with something different in each, because an identical record every quarter is its own kind of evidence.
They confuse confidence with facts. The early customer letter was written to reassure. It did the opposite, because when the forensic report arrived weeks later it contradicted the letter, and the customer now had two documents from the same company that disagreed. Silence, or “we do not know yet and here is when we will”, would have cost less.
They send proof of the wrong thing. A cover page proves a document exists. A dashboard screenshot proves a tool was open. Neither proves the control did what the requirement says, on the systems in scope, during the period assessed.
A cover page proves a document exists. A dashboard screenshot proves a tool was open.