Halberd Systems, Amsterdam. Monday morning, week nine after the Stenmark surveillance audit. Iris Hartnell at her desk. Coffee cooling. The post-surveillance disclosure form filled out on screen, cursor blinking on the supplementary-information field above the signature line.
She has to send it. The question is what she puts in the supplementary-information field above the signature.
Eight weeks earlier. Monday, 09:47. Renaud Belmont's office on the third floor. The Stenmark surveillance audit is on the calendar in eight weeks.
Which one do you make first?
Tuesday afternoon. The SharePoint folder is called ISMS-2024. The last-modified date on the parent folder is twelve weeks ago, three days before Felix left. The folder contains seven sub-folders and forty-one loose files.
The Statement of Applicability is at the top, marked v3.2, dated nineteen months ago. The risk register is one folder down, last edited fourteen months ago. The internal audit programme spreadsheet has rows for Q1 and Q2 of last year filled in; Q3 and Q4 are empty. The management review folder contains minutes from one meeting in February and a calendar invite for May that was declined by every attendee.
Halberd has shipped three new platform features, signed two new pharma customers, and migrated the primary data store to a new region in that period. Eight risk-register rows are visible. For each row: Stale (needs rewrite), Still-Valid, or Missing-and-Required (the row should exist and does not).
End of week one. The risk register has been redlined. The picture is not as bad as Iris feared, and not as good as Renaud assumed. Felix did not falsify. He stopped maintaining.
Iris's calendar for week -7 has one anchor: a meeting with Marisol Quintero on Wednesday. Marisol controls the time budget for the controls testing Iris needs to do before Stenmark arrives. The agenda line reads "ISMS readiness, fifteen minutes." Iris will need more than fifteen minutes.
For each card: the documented control statement, the artefact attached as evidence, the team owner's quote when you ask. Classify each. Under-classifying Theatre as Real costs the most: it papers over the predecessor's gap and almost guarantees the surveillance auditor lands on it.
The Theatre controls trace back to Felix's habit of writing the SoA optimistically. How do you broach this with Renaud?
Each card shows the M1-classifier outcome, the surveillance-sampling probability that Jonas lands on it, and the remediation cost if it fails. Pick the controls you will deep-test. Wrong picks (low-risk picked over high-risk) become surveillance findings in M3.
On Iris's desk, week -4, Monday morning, sits a banker's box. Felix's leftovers. Three SoA print-outs, two USB sticks, a coffee mug with a faded Halberd logo, and an unopened envelope from Stenmark Certification dated four months ago, addressed to F. Westbrook.
Iris has not opened the envelope. She knows what is inside: the standard Stenmark surveillance-engagement letter for the SA1, the one Felix would have signed and returned. He never did.
She picks up the envelope. She puts it back down. She decides she will open it after she has finished the sample-allocation work, not before. The contents will not change the choices she has already made.
You have the classifier results, the sample-allocation picks, the redline outcome. What do you tell her?
End of week -4. Iris closes her laptop at 19:08 on a Friday. The classifier has run. The sample-allocation has run. Marisol has the picture. Renaud has the picture. The supplementary-information field on the post-surveillance disclosure form is already drafted, in pencil, in a notebook on her desk.
Four weeks remain before Stenmark arrives. The Theatre controls are in remediation. The Partials are scheduled for evidence-gathering sessions across weeks -3 and -2. The two probable findings are in the surfacing-to-Jonas plan.
Iris has earned her standing with Marisol. She has given Renaud something he can defend at the next Audit Committee. She has not yet had to make any of the difficult choices.
Then on Wednesday of week -3, at 14:08, the credential-stuffing alert lands.
End of week -4. Iris closes her laptop at 20:34. The picture is mostly there. Some of the classifier picks could have been sharper. The sample-allocation missed one control she knows she should have included.
Marisol has half the picture. Renaud has less than half. The supplementary-information field on the post-surveillance disclosure form is not yet drafted.
Four weeks remain. The remediation plan exists but not in writing. Iris has the next four weekends already lined up.
Then on Wednesday of week -3, at 14:08, the credential-stuffing alert lands.
End of week -4. Iris is still at her desk at 22:11 on a Friday. The classifier picks are not all defensible. The sample-allocation missed at least two high-risk controls. Marisol has been told the work is on track. Renaud has been told nothing of substance.
The supplementary-information field on the post-surveillance disclosure form does not yet exist as a concept in her head.
Four weeks remain. The remediation plan is incomplete. The probable major NC is still inside the SoA folder, unsurfaced.
Then on Wednesday of week -3, at 14:08, the credential-stuffing alert lands.
Iris at her desk. Monday week +9, 08:14. The cursor is still blinking on the supplementary-information field.