Fear Not the Assessor

Dear Client,

I know you have reservations about going through an assessment so I propose a mutual commitment of things we can both do to make this process as  painless as possible:

You agree to do the following:

1. Gather as many of the policies, procedures, and supporting documentation available before I arrive.  In other words, if you say you do something, be able to provide some sort of evidence that it is being done.
2. Schedule  interviews with the people who “do” the actual work, not the managers that think they know what’s happening down in the trenches.  I’m sure you think you know what is supposed to occur, but in the interest of not wasting our time, I’d prefer to speak with those that actually do the work.
3. Identify your environment.  Make sure there is an updated network diagram and a matrix detailing all of the systems that deal with sensitive information.  For example, during the assessment is not the time to discover the backup of the production database under the receptionist’s desk, which was replicated “just in case.”

I agree to do the following:

1. I will not be your enemy.  My goal is not to publicly humiliate you or your staff.  The goal is to work together to identify any gaps in your infosec program in order to make it better.
2. I will not know everything there is to know. I encourage you to “push back” if you do not agree with anything I say or find.  I welcome conversation as it better helps me understand your environment.
3. I will not ask “trick questions.” If you want to mislead me, then that is on you.  I am going to ask you what I need and want to know.

An assessment can be a learning experience and by agreeing to the terms listed above you can expect the same courtesy in return.  As this can help in easing the pain that is….A security assessment.

Disclaimer: I do not speak for all infosec assessors, neither good nor bad.  These are my own thoughts based on my own experiences.