Helpful first: Write the risk sentence: cause, asset, and business impact
Key points
- Match preventive, detective, and corrective controls to the specific failure point in a risk sentence
- Distinguish policy statements ("we require MFA") from operating evidence ("100% of active directory tokens carry an AAL3 WebAuthn claim")
- Design continuous automated evidence collection (Control Monitoring) instead of annual manual screenshot hunts
Match the control mechanism to the risk sentence
In the previous lesson, Meridian Space & Robotics (chronos.) documented a concrete risk: If a departed contractor retains active OIDC and VPN credentials after contract termination, unauthorized commands could alter staging ground-station configurations (chronos-). Now Staff Infrastructure Engineer Kael Cho and VP of Compliance Sloane Sterling must choose the control that actually breaks that causal chain.
Instead of piling on unrelated paperwork, Kael maps controls to three points on the timeline: Preventive (automatically revoke IdP sessions and short-lived certificates the moment HR marks a contract ended, plus enforce 4-hour token lifetimes), Detective (alert the SOC if any account tagged status=terminated attempts token refresh), and Corrective (run an automated playbook that isolates the workload and rolls back unauthorized config diffs).
| Control Objective | Implemented Control | Weak "Paper" Evidence | Strong Operational Evidence (Automated) |
|---|---|---|---|
| Timely contractor deprovisioning | SCIM webhook from HRIS to IdP revokes sessions within 5 minutes of termination | PDF copy of the Access Control Policy signed last year | Joined population query comparing HR termination timestamps against IdP revoked_ logs across the full 90-day audit window |
| Phishing-resistant admin sign-in | IdP policy enforces FIDO2/WebAuthn (acr=aal3) for all prod- roles | A single cropped screenshot of one engineer’s YubiKey enrollment page | Signed JSON export of the live Terraform IdP policy plus 30-day authentication logs showing zero non-AAL3 grants to prod- |
| Backup recoverability | Automated weekly restore drill of encrypted telemetry snapshots into an isolated VPC | Cron job configuration file showing pg_ is scheduled | Immutable restore verification log recording RTO duration, row-count checksum match, and query health check every Sunday |
Design effectiveness (Type I) vs Operating effectiveness (Type II)
Whether you are preparing for a SOC 2 examination, an ISO 27001 surveillance audit, or a FedRAMP authorization, auditors evaluate controls on two levels. Design effectiveness (Type I) asks whether the control is architected suitably on a given date: for example, does the Terraform configuration for chronos- require peer review and SCIM deprovisioning?
Operating effectiveness (Type II) asks whether that control actually ran consistently across the entire review period (typically 6 to 12 months) without silent bypasses. A policy PDF or a single point-in-time screenshot never proves operating effectiveness. Real operating evidence comes from immutable system logs, signed CI/CD attestations, and full-population configuration state queries.
Build evidence emission into the engineering control itself
When engineers treat compliance evidence as a manual chore performed two weeks before an audit, they waste hundreds of hours taking screenshots of consoles. When Kael Cho designs a control at Meridian, he asks: "What structured log or signed attestation does this control emit every time it runs?" When the weekly backup-restore job writes a signed JSON receipt to an append-only compliance bucket, the engineering metric and the audit evidence are the exact same artifact.
CHECK YOUR JUDGMENT
During an external SOC 2 Type II audit at Meridian Space & Robotics (chronos.orbital ), the auditor asks for evidence that all production database schema changes over the past six months were approved by an independent reviewer before deployment. Which artifact provides the strongest proof of operating effectiveness?
NEXT FIELD LESSON