‘We Have a Policy for That’ Is Not a Control
A perfect policy won’t save you from an imperfect implementation. Learn the five qualities that turn “we have a policy for that” into a control that holds up under assessment, plus a 15-minute self-test to check your work.
Risk Level
Read Time
Earlier this year, we talked about how vital policies and procedures are for technical compliance; this is still true. Ensuring strong documentation is essential for passing any cybersecurity assessment, as well as being a general best practice. However, what happens when you create perfect policy, but don’t follow through in practice with what you have documented? Coming to the assessment table with compliance claims that cannot be proven will cost you.
Policy only shows intent. Without care and intent behind control implementation, there can be an inherent gap between what a policy states and what is actually in place at your organization. By contrast, a control is something that is implemented, operating consistently, owned by someone, and is capable of leaving an evidence trail behind. In a perfect world, policy and control adherence would match. This, however, is not always the case, as we have seen in the CMMC ecosystem.
“Violating the False Claims Act”
In June 2026, LOGZONE Inc., an Alabama-based Defense Contractor agreed to pay $507,144 for failing to comply with stated cybersecurity compliance requirements under the False Claims Act. By falsely self-assessing and then claiming a perfect score of 110 for its implementation of NIST SP 800-171, LOGZONE opened themselves up to litigation. This has proven to not be uncommon - other False Claims Act violations have totaled millions of dollars in fines for false representation through self-assessment.
With CMMC Phase 2 paused and self-assessment still the main mechanism to prove compliance, this point is timely: a senior official’s affirmation is only as good as the controls behind it. Simply saying “we have a policy” is not a defensible position when the claim was about implementation.
There has been a loud vocal minority in the CMMC ecosystem in regards to the recent pause to required third-party assessments stating that CMMC controls are no longer required. This is misleading and wholly damaging to the security of the U.S. government. CMMC is still required by contracts and still must be met; the only pause was the requirement to have an assessment team check your work. Claiming a perfect score when you don’t meet those requirements has proved costly for companies who violate the False Claims Act.
“Marrying Policy and Implementation”
Making your policy reflect live environment configurations may sound daunting, but it doesn’t have to be. In fact, a good control should only have to focus on five specific properties, which were briefly touched on above.
A successful control will be:
Documented: A policy and procedure should exist, with written guidance for how the control is met.
Implemented: A technical or administrative mechanism should be in place.
Performed: The process should be performed regularly, as documented.
Managed: The performed process should have a named role who oversees the steps to completion and would notice or alert should the process stop.
Demonstrated: The process should produce evidence or artifacts that prove the process occurred.
Each of these steps should be clearly demonstrable in an assessment. If your policy says one thing, your admin states another, and your live environment demonstrates a third, you have three findings for a single control.
“Actionable Steps”
We get it; ensuring your documentation matches your live environment exactly is daunting, let alone in an environment with a third-party assessment looming. Here is a quick exercise to make it less stressful.
If your policies are written and your environment ready to be assessed, your goal is to check your work. Take a 15-minute self-test by picking three implementation statements from your policies or System Security Plan (SSP) and try to prove each one in 15 minutes or less by using actual artifacts. Do not rely strictly on memory or verbal assurances. Remember, in an actual assessment, saying “there is a policy for that” will not meet a control. As you check, ask these questions. Is the control implemented as written? Is the implementation actually completed as written? Is it clear who is responsible for the task? And finally, when the task is completed, is there a record generated proving that it actually occurred?
If you are able to successfully answer the above questions, chances are good that the control is ready to be scrutinized in a live assessment. However, if you are still unsure, you are not alone.
Hive Systems provides a wealth of readiness support, which includes documentation development services that are unique to your organization’s individual CMMC needs. Reach out to us today to see how we can help!
Ready to find out where your organization stands?
Follow us - stay ahead.
