Controls are too coarse
A control in a framework usually contains several distinct requirements. Asked whether the control is implemented, a team that has done three of five has no accurate answer. Yes overstates and no understates.
Objectives
An objective is one of the individual protective measures within a control: one thing a person could do, perform or complete. Each objective carries a protection factor, which indicates its relative value in protecting the organization.
A control's protection factor is the sum of the factors of the objectives a team has in place.
What it makes possible
- Partial credit. A team's risk falls with each objective it implements, and its exposure reflects exactly what remains.
- Precise gaps. A gap can be stated as three of five objectives unmet, with the three named. That is a starting point for work.
- Plain questions. Questions can be written around related objectives, so each one asks about a single thing.
- Baselines in common terms. A baseline is a set of objectives, so any baseline can be compared with any inventory.
- Inheritance that fits reality. A shared service often delivers some of a control's objectives and leaves others to its customers. Recording objectives shows exactly where the line falls.
Mapping to objectives
When assessment questions are written, they are mapped to objectives. Control numbers are useful for narrowing down what applies, and the record itself is kept at the level below.
Not applicable, objective by objective
The same precision applies to scope. An objective is not applicable only when the thing it governs is absent from the resource, and that is decided one objective at a time. Yes, No, or Not Applicable covers the rules.
How Risk Is Quantified shows how the protection factor enters the risk calculation.