8 Comply? Policy Evaluation: From Published to Proven
A policy that nobody follows is not a control. It is a PDF.
🗂️ Tessera Case: The library, reopened
Act I identified policy obligations and a conflict between revocation deadlines. The operating records now let you test those obligations. Keep design issues and operating results distinct, and preserve the population and cadence of each review.
8.1 What full access changes
Act I recorded design observations and evidence gaps. Act II adds operating records and permitted tests. You can now interview the people named in the policies, log into the systems the policies describe, pull the logs the policies say are kept, and read the meeting minutes where the controls are supposed to be reviewed. Each is a different kind of evidence, and Chapter 7 covers how to weigh it. Point it at the policy set itself.
Policies are the soft tissue of an information security management system. They are also the part an organisation finds easiest to produce and hardest to live by, because writing a policy is a writing problem and following one is a behaviour problem. A fast-growing company like Tessera can write an excellent policy library in a quarter with a good consultant and a long weekend. It cannot build the habits that make those policies operate in anything like the same timeframe. The gap between the two is where this chapter lives.
8.2 Compliance is not effectiveness
Compliance means meeting applicable requirements, which may themselves require effective operation. Effectiveness concerns achievement of the intended result. A well-written policy can establish a requirement without demonstrating either operating compliance or effectiveness.
For example, P-REV requires a monthly privileged review. A signed policy with no review record does not demonstrate compliance with that requirement. A completed review might meet its documented cadence but still miss service credentials, undermining the objective.
Assess design, implementation and operation separately. The management system’s performance-evaluation requirements and selected review controls need evidence of actual evaluation. Do not label the whole estate “compliant on paper” merely because documents mention the right topics.
8.3 The A.5 backbone
ISO/IEC 27001:2022 clusters its ninety-three controls into four themes, and Theme A.5, the organizational family, is the largest: thirty-seven controls, A.5.1 through A.5.37. Where the people controls (A.6) govern the human lifecycle, the physical controls (A.7) govern offices and devices, and the technological controls (A.8) govern systems, A.5 governs the organisation itself: its policies, its roles, its assets, its suppliers, its information, its incidents, and its compliance.
Think of A.5 as the governance backbone. It opens with the policies themselves (A.5.1, policies for information security) and the roles accountable for them (A.5.2, A.5.3, A.5.4). It sweeps up asset management (A.5.9 through A.5.13), access governance (A.5.15 through A.5.18), supplier and cloud relationships (A.5.19 through A.5.23), incident management (A.5.24 through A.5.28), continuity (A.5.29, A.5.30), legal and privacy obligations (A.5.31 through A.5.34), and the review and compliance machinery meant to hold it all together (A.5.35, A.5.36, A.5.37). Strip out A.5 and the other three themes have nothing to attach to, because A.5 is where the organisation says what it will do. The other themes are where it does it.
That makes A.5 the natural home for the policy-effectiveness question, and it makes the Statement of Applicability’s status column the first place an auditor looks for the gap. In Act I you read that column and noted, with discipline, that “implemented” is an assertion. In Act II you can test it. Pick a control, take the policy at its word, and find out whether the word is true.
8.4 From published to operating: how to test a policy
Testing whether a policy operates is a four-step move, and it works on any A.5 control.
Read the policy for its operational claims. Most policies mix aspiration with obligation. Your job is to extract the obligations: the things the policy says will happen, on a cadence, by a named owner, to a defined standard. “Access rights are reviewed quarterly” is an operational claim. “Security is a core value” is not. Underline the claims. Each one is a test waiting to be designed.
Identify the evidence the claim would produce if it were true. A quarterly access review leaves a footprint: a signed review record, a ticket, a change log, a meeting minute. A 24-hour leaver-revocation control leaves a footprint: a revocation timestamp in the identity provider, correlated against the HR termination date. If the control operates, the world looks a particular way. Decide what that way is before you go looking, so you test the claim rather than your own surprise.
Gather the evidence, then compare it to the claim. This is where full access earns its keep. Pull the population (every leaver, every privileged account, every supplier), not the sample the client offers you. Trace the operational claim through the population. Count the exceptions.
Form a judgement tied to the criterion. State whether the tested items meet it, the exception count and what that implies about effectiveness within the tested scope. A control that operates for 95 per cent of the population and fails for 5 per cent is not “mostly compliant.” It is a control with a measured exception rate, and the consequence of that rate depends entirely on which 5 per cent.
Use the procedures in chapter 7: inquiry, inspection, observation, re-performance and re-computation as appropriate. Their value depends on the assertion and source quality. Preserve the record behind each result.
🗂️ Tessera Case: A.5.18 access rights, tested
Use E03, E04 and E06, keeping the populations separate.
The leaver test, F01. Both approved historical deadlines apply to the same full-revocation objective. Testing E04 yields three exceptions to 24 hours (L007, L019, L031) and four to two hours (also L044). The worst is L007’s 47-day key. E05 supplies incident evidence separately; an exception rate alone does not establish misuse.
The quarterly review test, F02. P-REV requires ordinary-access reviews for AWS, Workspace and Slack each quarter. E06 contains signed records for AWS and Workspace for the quarter ending March 2026, but none for Slack. The supplied result is incomplete quarterly coverage of the three-system population.
The monthly privileged test, also F02. January–March 2026 review evidence is absent for the separate privileged population, including service credentials. A calendar reminder does not establish completed reviews. Keep this monthly requirement distinct from the quarterly ordinary-access requirement.
The authorisation concern, P01. E11’s three requests met their expected decisions. This bounded pass belongs in the record alongside the failures. It does not close F01 or F02 because it tests different assertions.
Management’s June 19 policy revision aligns the deadlines to two hours prospectively. E10 supplies the limited follow-up; it does not erase the historical exceptions.
Report the result under each approved rule while seeking an authorised interpretation or correction. Do not choose the weaker requirement because it produces fewer exceptions. Record the decision’s effective date. A new rule does not automatically rewrite the criteria that applied during historical testing.
An illustrative summary says “quarterly privileged reviews were missed twice.” E06 says something different: incomplete quarterly ordinary-access coverage, and no supplied monthly privileged reviews for January–March. Preserve cadence, population and period in the correction. A polished summary that merges them changes the finding.
E07 describes an enabled support assistant missing from the processing register, with incomplete terms and unverified settings. P-PRIV requires that information before enablement. Assess actual deployment against that requirement. An acceptable-use policy can also need revision as tools and data flows change; its existence is not evidence that a particular deployment was approved.
Time: 25 minutes. No AI required. Build a four-row gap map: historical revocation under P-IT, historical revocation under P-HR, quarterly ordinary review and monthly privileged review. Give criterion, population/period, evidence IDs, result and finding ID. Explain why E11’s pass cannot close either access finding.
8.5 The question, answered
The policies contain testable obligations. E04 establishes historical exceptions, while E06 cannot substantiate the required review coverage. Keep F01 and F02 separate and carry both forward. The next chapter follows the assistant’s personal-information flow.