System Assessment and Authorisation, is it a thing to build a career on any more?
Was it ever? If you fall into a GRC role can you ever escape?
I have no idea, I do have opinions.
I’m planning on writing about GRC / A&A / and some vibe coding I want to do to automate “my way”
In halls of silicon, in vaults of code,
Where data streams in a rushing flood,
There lies a path, a rigorous road,
To prove the system is safe from mud.
Not just a flick of a toggle switch,
Nor a casual nod to a clever glitch,
But a formal dance of risk and state:
The Authority to Operate.
The ISM stands as the guiding light,
A lexicon of guards for the digital night.
It spoke of controls, of the “must” and “should,”
Defining the boundaries of the “securely good.”
From the physical lock to the encrypted vein,
It maps the terrain to minimise pain.
First comes the Assessment, the scrutinising eye,
Where auditors question and vulnerabilities lie.
“Is the patching current? Is the access tight?
Does the audit log shine in the forensic light?”
The gaps are unearthed, the weaknesses shown,
And the true posture of the system is known.
Then comes the Risk, the weight on the scale,
Where the “likely” and “severe” tell a cautionary tale.
For no system is perfect, no wall is absolute,
But the danger must be managed, the chaos mute.
Mitigations are drafted, offsets are planned,
Until the residual risk is a burden we can stand.
The Security Assessment Report is the tome,
The evidence gathered, the security home.
It translates the technical into the strategic,
Turning the complex into the systemic.
Then the Authorising Delegate, the one with the seal,
Reviews the evidence, makes the commitment real.
They weigh the operational need against the threat,
A calculated gamble, a professional bet.
“I accept this risk,” the signature declares,
“The system is ready; we can handle the snares.”
An ATO is granted—the green light is thrown,
The system may venture into the unknown.
But the victory is fleeting, the cycle is round,
For the threats of tomorrow are already unbound.
Continuous monitoring, the vigilant watch,
Ensuring no failure can open a notch.
For the ATO is not a trophy to keep,
But a promise to guard while the operators sleep.
Aligned with the ISM, disciplined and true,
The cycle begins… and we start it anew.
Prompt by me, “Write me a poem about Authority to Operate as described in the ISM”
Poem slop by gemma-4-31b-it-4bit, oMLX on M4 Pro Mini with 64GB Unified Memory
Images by Gemini using each stanza as a prompt. Banner Image by Co-Pilot.