Back to: The Story Must be Told

Regardless of the control framework or standard we work with, the following fundamental narrative elements apply.

Each control response and test design description narrative must contain as many of the following four (4) categories as possible to be considered complete.

• People: Who is involved with ensuring a control requirement is compliant and effective? The Who might be the HR Department, or the CISO, or Jane Doe specifically.

• Processes: Every company has a method of operating and performing tasks. These processes should be defined in a way that everyone understands how that process works to enforce control effectiveness.

• Policies: There is frequently a policy, or procedural document in place (or should be!) to define how a client sets the standard, or process, or regulatory requirement.

• Technologies: Most control requirements have a technical implementation for effectiveness and enforcement. It may be an external service provider, or an internal technology, but regardless, define it. Provide product names, platform names, third-party names, and all the details needed to completely articulate what is in scope and under test.