The flat report
A conventional compliance check compares a resource with a baseline and lists everything that is unmet. The whole list lands on the resource team, as though the team could fix all of it.
Often it cannot. Some of the gaps belong to a shared service the resource relies on, and some to a vendor.
Three layers
- The vendor. What a supplier's product or service does and does not provide.
- The shared service. Controls delivered by a common control service inside the organization.
- The team. The controls the resource team implements itself, including how it configures and uses what the other two provide.
A resource inherits from the services it uses, and those services inherit from their vendors. Each control is judged once, at the layer that owns it.
Routing the gap
| Where the gap sits | Who acts on it | What the dependent team does |
|---|---|---|
| The vendor | The gap stays attributed to the vendor | Compensates with a control of its own, or accepts the risk and records it |
| A shared service | The provider fixes it once, for every team that relies on the service | Sees the gap through inheritance, and compensates or escalates if it cannot wait |
| The team | The team | Plans and carries out the remediation |
Why it matters
- Effort goes where it belongs. A provider's gap is fixed once and is not chased in a hundred plans.
- The picture is accurate. One gap at a provider is counted as one gap, with its full reach visible.
- Teams are not blamed for what they cannot fix. That keeps reporting honest.
A gap you don't own is still your risk
Routing a gap to its owner does not remove the risk from the resource that depends on it. A missing vendor feature never excuses a control. The team compensates or accepts, and the decision is recorded.
D&D: Dependency Trees and Drift describes how the dependencies behind this are recorded.