← WRITING · GRC NOTE
A control is not a policy.
A policy states intent. A control is the repeatable behavior that makes the intent true on an ordinary Tuesday, with an owner, a scope, a test, and evidence.
By Zion Boggan ·
A policy states intent. A control is the repeatable behavior that makes the intent true on an ordinary Tuesday, with an owner, a scope, a test, and evidence.
By Zion Boggan ·
The audit question is not “do you have a policy?” It is “show me what happened the last time this control ran.”
Start with the risk, not the framework spreadsheet. “Access is reviewed” is vague. “Unneeded privileged access is removed before it becomes a standing path to material impact” gives the control a job.
State the risk reduced in observable language. Avoid “improve security” and name the condition the control changes.
Name the authoritative inventory. A review cannot prove coverage if nobody can say what was in scope.
Name a role or person with authority to correct the result. A shared mailbox is not an owner.
Write the steps, decision points, escalation, and stop conditions. Include what counts as a failure.
Keep the source population, procedure output, timestamps, operator, result, and remediation receipt.
Record the approving owner, exact scope, compensating measure, expiration, and return condition.
The control owner reviews the authoritative privileged-account list every 30 days. Each account must have a named person, a purpose, an approval, and an end date. The operator exports the list, joins it to approvals, removes or escalates anything unmatched, and stores the resulting receipts.
An auditor should be able to repeat the test without asking the operator to interpret a dashboard. If the operator has to explain what the green number means, the number is a lead, not evidence.
Use one internal control across public frameworks when its design genuinely supports each outcome. Do not create five copies of the same activity to fill five spreadsheets. A well-designed access review may support governance, identity, access control, and measurable performance outcomes at once.
Useful public references include NIST CSF 2.0, NIST SP 800-53 Rev. 5, and CISA Cybersecurity Performance Goals. The map is evidence of coverage, not a claim that one row completes a framework.
A control survives an audit when it survives ordinary work first.