With hundreds of framework controls and one engineer-quarter, how do you choose which get automated checks?

## The question behind the question Nobody automates a whole framework. The interview is testing whether you can defend an allocation to a security lead, a control owner and an auditor at the same time, when each of them would sort the list differently. ## Step one: classify, do not estimate Before any sequencing, put every control into one of four dispositions. This step alone usually removes a third of the list. - **Provider-satisfied.** Under a shared-responsibility split, some controls are met by the platform operator rather than by you — physical access to the facility, media sanitisation when a disk is retired, environmental controls in the building. You cannot check these and should not try; the artefact is a citation to the responsibility boundary and to whatever assurance the provider publishes. The engineering cost is zero and the correct output is a paragraph. - **Human process.** Training, screening, disciplinary process, annual policy review. The artefact is a collected record plus a named attestation, on a cadence. - **Machine-checkable.** There is a field to read and a rule to write. - **Machine-checkable but expensive.** The fact exists but reaching it requires a new integration, a data pipeline, or a behavioural probe rather than a configuration read. These compete with the plain machine-checkable ones on the same axes but at several times the cost. ## Step two: sort on drift, then toil Among the machine-checkable controls, the two axes that actually predict value are: **Drift rate.** Ask: can this fact become false without anyone intending to change it? Cloud configuration drifts because hundreds of people with legitimate access make thousands of changes; a retention value, a public-exposure setting, an encryption flag can silently flip. A control over an artefact that only changes when a human deliberately edits it — a signed contract, a policy document, an annually reviewed register — does not drift, and a continuous check on it will return the same answer every hour for a year. Continuous checking buys you *detection of unintended change*. Where unintended change is impossible, it buys almost nothing. **Evidence toil.** Count the hours the current audit cycle spends proving this control by hand: screenshots, exports, spreadsheets reconciled across accounts. Toil scales with the number of instances, so a control that applies to one system and one that applies to four hundred are wildly different investments even when the rule is identical. Risk is the tiebreak. It feels wrong to demote it, and the reason is worth saying out loud in an interview: risk tells you how bad it is if the control is *not met*, while drift tells you how likely you are to *find out late*. Automation addresses the second. A high-risk control whose state is verified at design time and cannot regress is better served by a design review than by a nightly scan. ## Step three: the anti-patterns to name - **Sorting by ease.** The cheapest checks are cheap because the facts are simple and stable, so a quarter spent this way yields a wall of green over things that were never going to change. - **Automating the provider's controls.** Building a check to prove something you do not operate is pure waste, and worse, it invents an assertion the shared-responsibility boundary already answers. - **Automating to raise the pass rate.** A programme measured on percentage green will optimise toward controls that pass trivially. Measure asserted facts machine-verified instead. - **Ignoring who carries what you did not automate.** Every control left manual lands on a person each cycle. A plan that automates ten controls and quietly adds twenty quarterly attestations to one overworked owner will fail in month seven. ## Step four: say what the plan costs The deliverable is not a ranked list; it is a ranked list with three attached statements. What gets automated this quarter and what that removes from the manual cycle. What stays manual, who owns each attestation, and at what cadence. What is provider-satisfied and therefore permanently out of engineering scope. Handing an auditor that third category up front is unexpectedly effective, because it turns "you have no check for this" into "we have a boundary and here is the citation". ## Interview signal The strong answer classifies before sequencing, argues drift over risk with a reason rather than a slogan, names the ease-sorting trap, and accounts for the manual burden the plan creates. A weak answer sorts by framework clause order, or by whichever checks the team already knows how to write, and never mentions who carries the residue.