Security and compliance: two perspectives on the same work

Start with what could go wrong

Information security is about protecting the confidentiality, integrity and availability of information. The work starts with the organisation's needs, threats and potential consequences. A measure needs to provide value in the environment where it is used.

Compliance also stems from obligations under legislation, contracts or standards. It requires the organisation to identify relevant requirements and demonstrate how they are addressed. An assessment passed at one point in time does not replace ongoing security work.

The same measure can support both

Take an access review as an example. The security benefit is that people do not retain unnecessary access. A documented process also shows who reviews access, how often and how exceptions are followed up.

A restore test works in a similar way. It tests whether information can actually be recovered. The results, identified shortcomings and agreed actions provide evidence for follow-up.

Avoid two separate sets of paperwork

Connect risks, requirements and controls to the same responsibilities and working practices. Describe what needs to be done, who will do it and which evidence demonstrates the result. Reuse actual documentation from the work where relevant.

Do not focus solely on collecting documents ahead of an audit. If the evidence does not reflect how the service is used, there is a gap to address, even if the documentation appears complete.

Make the provider's role clear

An operations partner can contribute controls and documentation within its service scope. The customer still needs to manage its own processes, users and applicable requirements. Define shared responsibilities that can be followed up. The goal is both effective protection and a clear account of the work.