Documentation plays a critical role in organizations. It serves to establish guidelines, plan, record events, transfer information, and more. Nowadays, more and more documentation is being created\u2014whether due to internal needs, regulatory requirements, or contractual obligations.<\/p>\n\n\n\n
We have policies, procedures, records, plans, matrices, forms, and manuals. Each one with its name, code, and version\u2014approved, signed, and archived. <\/p>\n\n\n\n
So we\u2019re covered\u2014because we have it documented. In many cases, there\u2019s a belief that simply having the appropriate documentation means everything will work. But that \u201ccoverage\u201d is just an illusion.<\/p>\n\n\n\n
When someone asks how a specific task is performed, there are pages and pages describing how to carry it out. And simply having that paper or file gives us a sense of relief. It seems the focus is on having documentation.<\/p>\n\n\n\n
But when it comes to security, having controls documented doesn\u2019t make them effective against attackers. It\u2019s not enough.<\/p>\n\n\n\n
This first question is key to understanding whether we are actually living in two separate organizations: one that exists on paper and another that functions in practice\u2014even if they don\u2019t always align.<\/p>\n\n\n\n
We don\u2019t need documentation if it only exists to keep us \u201ccovered\u201d. It doesn\u2019t reflect reality, and therefore, isn\u2019t used. <\/p>\n\n\n\n
If we need to block out time in the calendar once a year to review a document that no one looks at again until the next annual review, that document is not useful.<\/p>\n\n\n\n
When it comes to information security, this question is critical. An incident response plan is useless if no one reads it until the day an attack happens. The same goes for a risk matrix\u2014risks aren\u2019t reduced through an annual review, but through continuous practice.<\/p>\n\n\n\n
Living documentation doesn\u2019t need reminders to be reviewed (beyond the mandatory compliance checks). It is under constant scrutiny because it is used every day, consulted, adjusted, and improved.<\/p>\n\n\n\n
It\u2019s everything that is written and actually absorbed by people, becomes part of the culture, and is constantly fed by reality. It evolves from being a requirement to becoming a true tool\u2014one worth maintaining.<\/p>\n\n\n\n
Documentation only makes sense when it is alive. It guides, helps, protects, and evolves.<\/p>","protected":false},"excerpt":{"rendered":"
Lo tenemos documentado La documentaci\u00f3n es un elemento muy importante en las organizaciones. Sirve para establecer lineamientos, planear, registrar eventos, transferir informaci\u00f3n, etc. En los tiempos que corren, se crean cada vez m\u00e1s documentaci\u00f3n. Ya sea por necesidad propia, normativa o contractual. Se tienen pol\u00edticas, procedimientos, registros, planes, matrices, formularios, manuales. Todos con su nombre, […]<\/p>\n","protected":false},"author":15,"featured_media":7108,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"nf_dc_page":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[48],"tags":[],"class_list":["post-7107","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":{"bajada":""},"yoast_head":"\n