“Security is a process, not a product. Products provide some protection, but the only way to effectively do business in an insecure world is to put processes in place that recognize the inherent insecurity in the products.”Bruce Schneier · The Process of Security · 2000 · Bruce Schneier, «The Process of Security», revista Information Security, aprilie 2000 — paragraful de deschidere
The certificate is a photograph, and security is the film it was cut from.
Schneier's sentence is a quarter of a century old and still the best objection to compliance treated as a destination. A certificate says that, on the audit days, a sample of evidence matched the requirements. The system that produced that evidence can be abandoned the next morning and the certificate stays valid until the next surveillance visit. The certificate is a photograph; security is the film it was cut from. Hence the practical test for any compliance programme: if a control only works when an audit approaches, the control does not exist, only audit preparation does. The signs are easy to spot: a year of access reviews all performed in the same week; logs collected retroactively; training completed by everyone in three days. ISO/IEC 27001 is built against exactly this pattern, because it requires measurement (9.1), internal audit (9.2), management review (9.3) and corrective action (10.2). That is cadence, not an event.
There is a cost difference between the two ways of thinking. A product is bought once, at delivery, and it ends there. A process is paid for monthly, in time and attention, and never ends. That is why many firms choose the photograph: it looks cheaper on paper. But the real price shows up at the incident, when the certificate stops nothing. Think of the window at home: a good lock bought once helps little if you never lock it at night. Security works the same way — the habit of locking, not the lock, is the protection. The next question follows naturally: if the process is the film, who keeps the camera running between audits?
A certificate has a strange property: it outlives the system that earned it. You could stop every monthly check tomorrow, and the paper stays valid until the next visit. That is why a surveillance auditor reads not only what the evidence shows, but when it was created. A familiar example: a student who crams only the night before the test gets the grade, but does not know the subject. Likewise, access logs all reviewed in the same week before an audit tell a story nobody wrote down explicitly. A steady rhythm, with small but frequent records, is the only sign that a control lives between checks. What remains to be seen is who in the company should own that rhythm as a daily responsibility.
The passages so far left a question: who owns the rhythm? Schneier's answer is uncomfortable: there is no natural owner. Security is a process, and a process has no single owner — it has participants. The accountant doesn't do security, yet follows an access policy. The admin doesn't do accounting, yet keeps the logs. The rhythm lives only if everyone sees their piece as part of their own work, not as a favor to the auditor. Hence the reverse test: ask someone outside the security team what they did for security this month. If the answer is "nothing, not my job," the process doesn't exist — only a small team preparing photographs. Think of cleaning in an apartment building: the stairwell stays clean only if every neighbor does their part, not if a cleaner comes before the manager's visit. What remains to see is what happens to the rhythm when people leave the company.
Passage 3 left the door open on people leaving. Here lies the real test of a process: if the rhythm lives only inside certain heads, it leaves with them. A true process does not depend on memory, but on a written, repeatable routine. The access review can be done by anyone, every month, if the steps are written down and the calendar exists. When the admin leaves, the new colleague opens the list and continues, without asking anyone how it was done. If only one person knows how logs are collected, the company does not have a control — it has a person. Think of grandma's recipe: if it is not written down, it dies with her. A written process survives change, the way the film keeps rolling when the camera operator is replaced. The next question is what to do when the written routine actually breaks.
Passage 4 left the question open: what do you do when the written routine actually breaks. This is where the process shows its real value. A good process does not claim nothing goes wrong; it defines what happens then. Who notices, who decides, who fixes, who records the lesson. The difference is not between firms without incidents and firms with incidents — incidents happen everywhere. The difference is between those that hide the hole and those that repair it and change the routine. Think of a burst pipe: a plumber who only plugs the hole leaves the problem to return; one who tells you why the pipe cracked changes how you maintain it. An incident handled this way becomes fuel for the process, not proof of failure. What remains to be seen is what a process that has learned looks like, compared to one that merely survived.
Why it matters The surveillance auditor looks for traces of rhythm, and evidence crammed into the final week tells its own story.