The Control Catalogue, Evidence and Assurance as the Architect's Artefacts

All courses / The Transformed Security Architect / Module 2 / Chapter 9

Learning objectives

After the lesson the participant can:

• Explain which three connections the architect owns in the catalogue and where that ownership stops.
• Write a complete control entry with a falsifiable objective, an implemented_by path, a test, evidence with a fail condition and reviewed mappings.
• Classify controls as verified, declared or failed by rule and open a finding for every status other than verified.
• Describe how a catalogue as code changes the work of the auditor while preserving independence.

Key concepts

Falsifiable objective

One sentence that a test can disprove, such as: an agent cannot call a tool that its manifest does not name. A sentence such as 'access is appropriately managed' cannot be tested and so cannot be verified.

Assure once, comply many

A control is written once and mapped to every obligation it serves, each mapping with its relation, reviewer and date. Written four times it would drift into four controls; mapped four times it is tested once and the result serves every column.

Fail condition and maximum age

The fail condition names the observation that would prove failure, since a query that describes success invites confirmation. The maximum age turns a control declared the day its evidence expires, which also catches a collector that silently stops.

Verified, declared, failed

Verified: test passed within cadence and machine-generated evidence within its maximum age. Declared: no recent passing test, stale evidence or attestation only. Failed: the last test failed or the evidence query returned its fail condition. There is no amber.

Shared dependency

Two controls that depend on the same tool gateway or model provider fail together, so the coverage view counts controls with a common dependency as one. Counting controls is not the same as counting protection.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A declared entry is a known gap, not an error. How would your management review react to a first report in which most controls are declared, and how would you prepare it?
2. The chapter says evidence a system produces about itself is weaker than evidence from outside it. Which of your current evidence sources would fail that test?
3. Hansa brings the United Kingdom and Swiss mappings into the catalogue as entries the local security officers own. Why does the chapter keep authorship with them?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Who or what sets the status of a control in the chapter's design?

   1. A rule applied in the pipeline, owned by the architect and reviewed by the CISO
   2. The control owner, who types it in after each test
   3. The evidence-collection agent, which may promote controls it has checked
   4. Internal audit, at the annual management review
   Show the answer

   A. A rule applied in the pipeline, owned by the architect and reviewed by the CISO
   A rule owned by the architect and reviewed by the CISO applies the status in the pipeline, so no control owner can type it in. The evidence-collection agent refreshes evidence but cannot alter the rule, the tests or the exceptions.

2. In the first report from Nordvik's catalogue, why is CTRL-LOG-001 classified as failed?

   1. The supplier TriageSoft had provided only a written statement, with no evidence the Region could collect itself
   2. The evidence for the control was older than its maximum age
   3. A replay found the managed security service provider's detections cover only some Region scenarios
   4. The entry had no owner and so did not pass the validator
   Show the answer

   C. A replay found the managed security service provider's detections cover only some Region scenarios
   The replay found that the managed security service provider's detections cover only some of the Region's scenarios, so the control did not work as its objective states. The finding goes to the CISO for the contract discussion.

3. What does the coverage view say about CTRL-AGT-002 enforcing three agents' permission manifests through the same tool gateway?

   1. That the three agents are protected by three independent controls
   2. That the gateway is one point of failure, leading to a second independent control or an accepted risk
   3. That the control must be split into one catalogue entry per agent, each with its own test and separate evidence
   4. That the control answers no threat and is a candidate for retirement
   Show the answer

   B. That the gateway is one point of failure, leading to a second independent control or an accepted risk
   Each agent has its own manifest, but the same tool gateway enforces all three, which is one point of failure. The finding leads to a second, independent control or to an accepted risk with an expiring exception.