Three words

This is the second in an occasional series of real findings from real assessments, anonymised: no organisation, no vendor, no tooling, no internal reference numbers. The first was three approved documents disagreeing about one control. This one is smaller, and it is about a single cell in a single document.

What the cell says

An organisation’s statement of applicability lists every control in ISO 27001 Annex A and says, for each, whether it applies and why. The control here is clock synchronisation: keeping the clocks of the systems that matter set to an agreed time source, so that a log entry on one system can be placed in order against a log entry on another.

The control is marked as implemented. The justification, in full, is a vendor’s name followed by two words: “[Vendor] time synced.”

Nothing else is there. No statement of which systems are covered. No time source. No account of who checks that the clocks still agree, or how often, or what happens when they do not. Three words, and the control reads as settled.

Nothing here is false

The words may well be true. The vendor’s platform may keep the organisation’s devices synchronised by default, and the person who wrote the entry may have known exactly how. This is the finding, not a defect in the person: the entry records that a conclusion was reached and none of what it rested on.

Read the cell as an auditor or a board would, a year later, and it cannot be told apart from a control that was examined carefully. It does not say what is in scope, so it cannot be wrong about scope. It names no cadence, so it cannot be out of date. A justification that commits to nothing cannot be contradicted by anything, and so nothing prompts anyone to revisit it.

That is why it lasts. A finding that looks like an error gets corrected at the next review. A finding that looks like a complete answer is left as it is.

What a justification is for

A justification exists so that someone other than its author can tell what the organisation does, to what, how often, and who would notice if it stopped. Four things, in plain terms:

• the scope: which systems the control covers, and which it leaves out;
• the activity: what is actually done, as distinct from what a product is capable of;
• the cadence: how often it is checked;
• the owner: who is answerable for it.

The three words give the name of a product and stop there. A product being present is not the same as a control operating. The first is a purchasing fact. The second is something a person does, or arranges, and can be asked about.

Why this one in particular

The independent review of the July 2026 national telecommunications outage, which we wrote about last month, found that the failure ran through network time synchronisation, that responsibility for it was unclear, and that the timing function had not been treated as high risk.

We are not drawing a line from a three-word justification to that outage. The organisation in this finding is not a telecommunications provider, and a short justification is not evidence that a timing control fails to operate. What the two share is only a shape: a function that sits underneath everything else, that works unnoticed until it does not, and that is easy to record as handled without anyone having to say what handling consists of.

Time is also a poor candidate for being overlooked. When clocks disagree, logs cannot be correlated, and reconstructing the order of events after an incident becomes guesswork. Few controls are cheaper to describe properly, and few are more costly to find undescribed afterwards.

The cheapest fix in the register

Most findings take work. This one takes an afternoon. Someone who knows how the clocks are kept writes down the systems covered, the time source, how drift is checked and how often, and who owns it. Perhaps four sentences. If that person cannot be found, or cannot say, that is a more important finding than the one the cell was hiding.

It also takes no tooling. You can do it before you speak to anyone: open your statement of applicability and read down the justification column. Count the entries that name a product and nothing else. Pick the three that your organisation depends on most and ask, of each, who could explain it to a stranger.

What Frank does with it

Frank flags a justification that is short and generic: one with no measurable claim, such as a cadence, a time limit or a percentage, and fewer than two concrete activities, such as “documented” or “tested”. It marks the control as unsupported rather than wrong, because the entry may be true, and says beside the control what triggered the finding. It does not check whether the entry names a scope or an owner. That part is still a question for whoever wrote it.

You can see how your own justifications read. Start by seeing where you stand. It reads your own documents and shows you the entries that say a control is handled without saying how.