Preparing for a TPN assessment

Start with scope

Decide precisely which facilities, systems and workflows are in scope, and be able to draw the boundary on a diagram. Almost every difficult assessment traces back to a boundary nobody agreed.

Be honest about where content actually goes. If a workflow routinely leaves the scoped environment, either bring it in or change the workflow. Assessing a boundary that does not reflect reality wastes everyone time and produces assurance nobody should rely on.

Eight weeks out

Inventory the systems that touch content, including transfer tooling and anything a freelancer uses. Map who has access to what, and remove what has accumulated. Confirm which subcontractors are engaged and what they are contractually required to do.

This is also the point to fix the boring things: shared accounts, leavers with active access, and transfer tools adopted informally.

The three areas that produce most findings

Access control. Broad, long-lived access granted for a project that ended. The fix is unglamorous and effective: review, remove, and make removal part of project close.

Asset handling. Knowing where content is, in which state, and who moved it last. Where this is manual it will not survive a busy schedule.

Subcontractor management. The vendor of your vendor. Assessments increasingly ask, and the answer is often unknown.

Evidence

Evidence gathered the week before an assessment proves something about that week. Assessors know this, and the questions that follow are designed to find out whether the control operates the rest of the time.

The organisations that find assessment easy are the ones whose evidence accumulates as they work. That is a systems decision made months earlier, not something achievable in the run-up.

On the day

Have someone who actually operates the workflow in the room, not only the person who wrote the policy. Assessors ask how it works, and the honest operational answer is usually better than the documented one.

Where a control is partially implemented, say so and show the plan. A known gap with an owner and a date is treated very differently from one discovered by the assessor.