The assessment treadmill
In an assessment-centered program, a team answers a long questionnaire, the answers are filed, and a year or three later the team answers it again. Most of the answers have not changed.
The effort is repeated, and nothing accumulates.
An inventory that persists
FCR replaces the periodic assessment with a persistent control inventory. A resource team documents its security controls once, in an inventory that carries forward from year to year.
At each reassessment the team reviews the inventory and updates what has changed. The inventory is a living record of how the resource is protected.
What goes in it
The inventory records which control objectives are in place for the resource, and the evidence for them: a note on how it is done, or a link to where it can be seen.
It records what the team has implemented. The gaps are simply what remains, which keeps the exercise constructive.
One record, many uses
- The risk calculation uses it to work out how exposed the resource is.
- The security plan is generated from it.
- It can be compared with any baseline the organization cares about.
- Changes to it show whether gaps are being closed.
One Inventory, Many Baselines covers the third of these.
Shared services document once too
Providers of shared services keep inventories of their own and share them with the teams that depend on them. A team does not restate what a provider has already documented. How Common Control Services Work in FCR goes into the detail.