Build a Control Description from Messy Practice

The infrastructure team says firewall changes are reviewed in pull requests most of the time, but urgent SRE changes sometimes happen first and are cleaned up later. Translate reality into a testable control by naming objective, risk, actor, activity, evidence, and exceptions. The common trap is writing the idealized version: all firewall changes are approved before implementation. That sounds strong, but if emergency changes happen in production, the control will fail testing and lose credibility. Messy practice Firewall changes are usually approved in PRs. SRE can make urgent changes directly when production is at risk. Jira sometimes has the request.…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in