A reasonable belief
Teams that rely on centrally managed services often conclude that the services make them compliant. The belief is reasonable. A well-run shared service does implement many of the controls a standard requires.
What it leaves out
Standards nearly always place requirements on the consumer of a service as well as on its provider. A few examples show the pattern:
- An identity service authenticates users. The team still decides who should have access and removes people who leave.
- A backup service makes the copies. The team still decides what is backed up and confirms it can be restored.
- A hosting service patches the platform. The team still maintains the application it runs there.
In each case the service does its part well, and something remains with the customer.
What inheritance provides
When a team inherits from a verified shared service, it receives two things: the controls the service delivers, and a record of the responsibilities the service leaves with its customers.
The second is as important as the first. Without it, a team has no way to know what it still owes.
Attest to your own part
The team's plan then shows three kinds of control: those inherited from services, the customer responsibilities that came with them, and those the team implements entirely on its own.
The team attests to the last two. The provider's verification stands behind the first.
The security office's part
Identifying customer responsibilities is part of verifying a shared service. When the security office reviews what a service delivers, it also records what the service leaves undone. How Common Control Services Work in FCR describes that review.