Zero Security Theatre
Patterns and anti-patterns
Patterns are practices that help when tested. Anti-patterns are common, usually well-intentioned practices that create paperwork without improving the result.
Patterns
Store the query, not the screenshot
Keep the source, collection time, and query with the result so a reader can reproduce it. The same record is ready when an audit begins.
Anti-patterns
Presenting a certificate as evidence of resilience
A report describes a negotiated scope, at a point in time, against selected controls, many of which ask only whether a process exists. It is a procurement artifact and a requirement source.
Under Compliant Insecurity
Writing a narrative where no data source exists
Requirements with no operational evidence source produce prose, and prose always passes. The absence never appears as a failure in any report.