Key takeaway: Compliance verifies that you do what you said you do. Security requires that what you said is sufficient. An organisation can be fully compliant and trivially compromised.
What an Audit Actually Tests
An auditor examines whether stated controls existed and operated over a period. If your policy says access reviews happen quarterly, the auditor asks for evidence of four reviews. If evidence exists, the control passes.
Nothing in that process asks whether quarterly is frequent enough, whether the reviews were substantive, or whether the reviewer understood what they approved. A review consisting of a manager clicking approve on a list of two hundred entitlements satisfies the control and detects nothing.
This is not a flaw in auditing — it is what auditing is for. Frameworks establish a baseline and create accountability for stated practice. The error is treating a passed audit as evidence of adequate defence.
Where the Gap Shows
| Control area | Compliance satisfied by | What an attacker cares about |
|---|---|---|
| Access review | Documented periodic review | Whether standing privilege exists |
| Vulnerability management | Scanning on schedule | Time to patch internet-facing systems |
| Encryption | Data encrypted at rest | Whether keys are separated from data |
| Logging | Logs retained | Whether anyone would notice an intrusion |
| Incident response | A written plan | Whether the plan has been rehearsed |
| Vendor management | Questionnaires collected | Actual third-party exposure |
Encryption at rest is the clearest illustration. Cloud provider default encryption satisfies nearly every framework and stops exactly one threat — physical theft of a disk. It does nothing against a compromised application credential, which is how data is actually taken. The control is real, the checkbox is honest, and the protection against the realistic threat is nil.
Logging shows the same shape. Retaining logs for a year satisfies the requirement. Whether anyone reviews them, whether alerts fire on meaningful conditions, and whether the right sources are collected are separate questions that no framework asks precisely.
Using Compliance Productively
The programme is not worthless, and dismissing it wastes leverage. Certification unlocks enterprise sales, which funds security work that would otherwise go unfunded. It forces an asset inventory, which most organisations lack and which every security capability depends on. It establishes ownership for controls that previously belonged to nobody.
The way to use it well is to treat the framework as a floor and design controls for the threat rather than for the evidence. When the requirement says periodic access review, decide the interval from actual risk and implement just-in-time elevation so that standing privilege is small. That satisfies the auditor and also reduces the attack surface — the same work serving both purposes.
The failure mode is the reverse: designing the control to produce evidence with minimum effort. That yields a passed audit and no risk reduction, and it consumes the budget that genuine improvement needed.
Measuring Beyond the Framework
Track the things attackers exercise. Time to patch internet-facing vulnerabilities. Proportion of privileged access that is standing rather than temporary. Detection coverage against a technique framework. Time to detect in an exercise. Percentage of accounts on phishing-resistant authentication.
None of these appear on a compliance report. All of them predict whether an intrusion succeeds.
The Bottom Line
Pursue certification for the commercial and organisational benefits it delivers, then design each control against the threat rather than the evidence requirement. Measure outcomes attackers care about alongside the framework, because a clean report and a manageable breach are entirely compatible.
