Most of the time in an assessment is not spent on site, and it is not spent deciding whether a control is in place. It is spent opening files. A first Report on Compliance for a payments company produced, in its last four days, six versions of one standard and five of two others, and the review notes from that engagement are where these rules come from.
Match the label
Each evidence request says what kind of thing it is asking for: a configuration export, a dated review record, a screenshot of a specific setting, a policy. When the slot holds that type of file, we review it in minutes. When it holds something adjacent, a cover page, a slide, an email saying the thing exists, we open it, work out that it is not what was asked for, and write a note asking again. Read the request before choosing the file.
One current version
Submit one version of a document, the one that is in force, with a date and a version number on it. Six versions of a network standard in four days do not show diligence. They show that the document was being written during the assessment, and that is itself a finding, because a standard that did not exist for most of the period cannot have been followed for most of the period.
Annotate raw exports
A firewall ruleset export with four hundred lines is evidence of nothing until someone points at the lines that matter. Highlight the rules that serve the requirement. Add a sentence: these three rules restrict inbound traffic to the cardholder environment to these sources. The assessor can verify a claim. The assessor cannot guess what you meant to claim.
The assessor can verify a claim. The assessor cannot guess what you meant to claim.
Say so when you do not have it
If you do not have what is asked for, say so. A stated gap is quicker for both of us than a file we have to open only to rule it out. It is also, strangely, better for you. A gap you have named is a gap with an owner and a plan. A gap you have papered over with an unrelated document is a gap we find anyway, two weeks later, with less time left to close it.
Submit once per requirement
Collect the evidence for a requirement, check it against the request, then submit it once. A requirement that receives five partial submissions over three weeks is reviewed five times, and each review starts by working out what changed since the last one. One complete submission is reviewed once.
One named owner per finding
Every open finding needs one person whose name is next to it, who knows what would close it and who is doing the work. Findings owned by a team, a department or “IT” stay open. Findings owned by Marie close.
What people get wrong
They file for completeness instead of relevance. The instinct under pressure is to send everything that might help. The effect is to bury the one file that does.
They believe the document is the control. Evidence that a control is defined is the easy half. Evidence that it operated, during the period, on the systems in scope, is what the requirement asks for, and it is usually a log, a ticket or a dated record, not a policy.
They remediate and document in the same week. A control that was switched on the day before the evidence was gathered has no history. Switch it on, let it run, then gather the evidence it produced.