Who is answering
The person answering an assessment in a federated program is a member of a resource team. Assume they have basic project management skills and know their own processes and practices. Do not assume any security training.
Control frameworks are not written for that reader. The questions have to be.
Four steps
- Judge the fit. For each control, decide whether it applies in this context, in whole or in part.
- Derive the objectives. Break what applies into objectives. An objective is one thing a person could do, perform or complete.
- Group related objectives. Put objectives together by what they are about, whichever control they came from, so that each group supports a single question.
- Write the question and its help text. Use language that fits the context and the reader.
What counts as one objective
Objectives are smaller than they first appear. Reviewing a policy against standards is one objective. Reviewing it against regulations is a second.
Working at that level is what lets a team answer precisely, and be credited for the part it has done.
Help text that makes a yes mean something
Help text should be just long enough for a broad audience to understand, in plain language. Its job is to state what a yes confirms: each requirement covered by the question, spelled out.
A respondent who answers yes after reading it has confirmed something specific.
Ask only what the team can act on
Keep questions to the team's own interaction with its resource. What a vendor does is assessed separately, and what a shared service provides can be answered for the team automatically.
The answers themselves need rules too. Yes, No, or Not Applicable sets them out.