Machine-readable controls
State the subject, the expected condition, the data source, and the test. A machine can then run the check.
Research program
Compliant Insecurity
Compliant Insecurity is the condition of an organisation that holds every certificate its market asks for and still cannot detect, contain, or recover from an ordinary intrusion. This program studies how regulatory and contractual obligations move from periodic attestation to continuous operational evidence.
What evidence demonstrates that this requirement is working today?
What compliance can prove
Claim: hypothesis
HIPAA, SOC 2, HITRUST, NIST frameworks, ISO 27001, CMMC, PCI DSS, GDPR, state privacy laws, customer questionnaires, and contractual security schedules are useful sources of requirements. They tell an organisation what someone believes it should do. They are not evidence that it can survive an attack.
Buyers increasingly ask for the certificate during procurement and live evidence during risk review. This work asks how much of that evidence the running systems can produce automatically.
The framing and much of the source material for this program comes from Compliant Insecurity, which collects the pattern in detail.
Sources
From periodic attestation to continuous evidence
Claim: recommendation
The gap between two audits is where the interesting behaviour happens. Configuration drifts, an exception is granted and forgotten, a vendor changes, a control is disabled during an incident and never restored. Periodic evidence cannot see any of it.
Evidence with provenance
Every record says where it came from, when it was collected, and which query produced it. An auditor can run it again.
Drift detection
Continuous comparison of observed state against expected state, with the time between drift and detection as a metric in its own right.
Gap detection
Requirements with no mapped evidence source at all, which are the most common and least reported failure.
Policy as code
Where the platform can enforce a policy, generate the written policy from the enforced rule.
Continuous audit readiness
The evidence already exists when the audit starts, so a team does not spend a quarter assembling it.
Operational Truth
Claim: inference
Continuous evidence helps only when it describes what happened. Operational Truth separates what was intended, reported, recorded, inferred, observed, and independently verified. Without those labels, a clean record can be mistaken for a safe system.
The program uses these six labels from the Operational Truth material.
Sources
What would prove us wrong?
Claim: unknown
The program assumes continuous operational evidence predicts outcomes better than periodic compliance evidence.
- Environments where periodic audit evidence predicts incident outcomes as well as or better than continuous evidence, for example small, static systems with few changes between audits.
- Evidence that continuous controls monitoring reliably produces a high volume of technically true but operationally irrelevant findings, degrading attention.
- Data showing that certification alone correlates with lower loss, once size, sector, and spend are controlled for.
Experiments for this program
- Map every requirement to an operational data source How many requirements can be answered by a machine today?
- How long does drift survive? When a control is quietly disabled, how long before anyone notices?
Patterns and anti-patterns
- Store the query, not the screenshot (pattern)
- Presenting a certificate as evidence of resilience (anti-pattern)
- Writing a narrative where no data source exists (anti-pattern)
Evidence for this program
- NIST Cybersecurity Framework 2.0 Organises outcomes across govern, identify, protect, detect, respond, and recover. Used here as a requirement source, not as evidence of effect.
- NIST SP 800-53 revision 5, security and privacy controls A large control catalogue, useful for mapping requirements to testable statements.
- HHS, HIPAA Security Rule A frequent source of the compliant insecurity pattern, because many requirements ask whether a process exists.
- Compliant Insecurity Collected material on organisations that satisfy their frameworks while remaining unable to detect, contain, or recover.
- Operational Truth The intended, reported, recorded, inferred, observed, and verified distinction used throughout this area.
Research notes
Keep evidence that can be reproduced
A screenshot is a claim about a moment. A stored query with provenance can be re-run by the reader, which changes what the evidence is worth.
Requirements with no evidence source are more common than failed controls
When requirements are mapped to operational data sources, the largest category is usually requirements that no system can currently answer at all. These gaps matter more than failures, because a failed control is visible while a requirement with no data source produces a narrative that passes. The claim is untested.
The audit passed and the network was flat
Certification scope is negotiated. A clean report describes the environment that was examined against the controls that were selected, at the time of the examination.