Operate controls across assets and suppliers

Concepts and distinctions

Operational controls translate risk decisions into repeatable actions. Asset ownership, access reviews, secure configuration, change handling, supplier oversight and incident escalation are connected practices rather than isolated documents. A joiner process can grant appropriate access while an unmanaged role transfer quietly leaves obsolete privileges behind.

Outsourcing a service changes who performs work, but the organization still needs to understand its requirements and responsibilities. Define supplier duties, evidence, notification paths, change expectations and exit arrangements. A certificate or assurance report can inform due diligence only within its scope, period and limitations. It is not proof that every customer-specific configuration or subcontractor dependency is controlled.

Apply the process and collect evidence

Select evidence that matches the control claim. For an access review, identify the population, reviewer, decision records and removal verification. For a supplier, reconcile the contract with the actual service and interfaces. Test handoffs after staff changes and maintain exception handling when standard procedures cannot be followed. Avoid collecting unnecessary personal or confidential information merely to populate an audit folder.

Support, document control and implementation evidence

Resources, competence, awareness, communication and controlled documented information make operational controls repeatable. Distinguish attending training from demonstrating competence: a restore operator should show the authorized recovery procedure works. Maintain approved versions, access permissions, retention rules and change history for relevant documents. An obsolete procedure available to staff can undermine an otherwise correct control design.

A launch plan identifies accountable work, dependencies, milestones and acceptance evidence; management provides authority and resources while employees operate relevant procedures. During an audit, interview staff, observe work and inspect records rather than relying on one presentation. Remote audits need agreed secure access, identity checks, privacy protection and arrangements for activities that cannot be observed reliably. Screenshots and exports require context, dates and provenance. Penetration testing is a separate authorized assessment; an audit engagement does not automatically permit intrusive tests.