Adequate is not the same as sufficient
Evidence can be the right kind and still not enough of it. Adequacy is about whether an artifact answers the requirement; sufficiency is about whether it covers the scope.
Ideas and field notes
Blog
Practical writing about cybersecurity, compliance, and sustainable security operations.
Not all evidence is equally believable
Audit practice ranks evidence by how far it sits from the party with an interest in the outcome. Organizations can choose what their procedures produce, and stronger evidence usually costs no more than weak evidence.
What an annual security policy review should produce
An annual review should test a policy against current obligations and operations, then record decisions, evidence, owners, and follow-up work. Most standards require the review; few organizations get full value from it.
How do you know your security policy and procedures are being followed?
A useful policy and/or procedure identifies the evidence that will show whether the organization is actually following it.