Ideas and field notes

Blog

Practical writing about cybersecurity, compliance, and sustainable security operations.

Not all evidence is equally believable

Audit practice ranks evidence by how far it sits from the party with an interest in the outcome. Organizations can choose what their procedures produce, and stronger evidence usually costs no more than weak evidence.