Compliance Blog
THE LIFECYCLE
Seven steps. Plenty to talk about.
Follow the cycle, and revisit earlier decisions when something changes.
Prepare
Start with the work people need to do, the decisions someone has to own, and the questions we still need to answer.
Categorize
Talk through the consequences of losing confidentiality, integrity, or availability before settling on impact levels.
Select
Work out which requirements apply, how controls need to be tailored, and who will make each one work.
Implement
Turn selected controls into working safeguards and describe what actually happens when people use and maintain them.
Assess
Ask what the evidence supports, test the intended outcomes, and talk honestly about findings and uncertainty.
Authorize
Bring the mission, findings, and available responses together for a decision someone has the authority to make.
Monitor
Keep checking the controls, follow meaningful changes, and decide when earlier conclusions need another look.
Read in order, or start with the decision you’re working through. A new answer can send you back to an earlier step.