Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
10

Evidence over assertion

Every security claim carries its evidence, its assessor and its age, and only independent, current evidence counts as assurance.

4 min readInteractive figureISA/IEC 62443-2-1ISO/IEC 27001
Interactive figure
How much can this claim bear? SR 3.4 on PLC-201
Who judged it
42ASSURANCE
Self-assessed: capped at 76
Change who judged it, how much they covered, whether proof is attached and how old it is.

Adjust who assessed a control, its coverage and its age, and watch the assurance it can bear.

Compliance that cannot bear weight

A spreadsheet that says "compliant" is an assertion. It does not say who checked, how many assets were covered, what proof exists or whether that proof is still valid. Boards, regulators and insurers increasingly ask exactly those questions.

Building assurance

We open every engagement by evidencing where you stand and close it by proving the uplift. Evidence is attached to the asset and the control, reused across every framework that asks for it, and expires so it cannot silently go stale.

Judgements gain weight with independence: self-assessment by the owner, review by site security, and verification by an independent assessor. Only evidenced, independent and current claims are treated as audit-grade.

Takeaways
  1. 01Attach evidence to the asset and control it proves.
  2. 02Weight claims by independence, coverage and recency.
  3. 03Prove uplift; do not declare it.