When Evidence Of Readiness Is Mistaken For Readiness Itself

It rarely arrives all at once, which is what makes it easy to miss.

A supplier is asked for a policy. A couple of years later, a better one. A questionnaire gains a new section. A cyber standard appears that wasn't there before. Then comes evidence that it has been tested. Each step is small enough to be reasonable, and none of them arrives with a conversation.

What I have felt, over a long run of these, is the bar rising steadily, and I can't point to a moment when anyone explained why. The requirements simply got heavier, and the expectation was that they would be met.

On the surface it looks like a short list. A continuity plan, a cyber policy, a handful of procedures. It is only when you start that the real size of it appears. Each item has to be thought through, written, checked against how the business actually runs, and agreed by people who already have a full week. For a small or mid-sized business, that is rarely a task for a department. It is the owner's evenings.

What is almost never said is what the supplier gets for it. The buyer's reasons are usually sound, because they are protecting themselves, and they have every right to. But the supplier rarely hears what the requirement is protecting, what changes if they meet it, or whether meeting it improves their position in any way. Standards rise, the price stays under pressure, and nobody explains the return.

There is a second gap underneath. A document proving a plan exists says nothing about whether anyone could run it on a bad day. Evidence of readiness and readiness itself are different things, and most of what is produced is created once, quickly, and then filed.

I have taken to asking buyers a simple question when a continuity plan is requested: where is yours? It isn't meant as a challenge. For most suppliers, the bigger threat to the business isn't having to stop work for a couple of days, it's the work stopping coming, and no plan they write covers that. The question usually produces a pause, because the person asking has often never been asked it. They were told to request the plan, and nobody explained why.

That is worth saying plainly, because nobody in this is behaving badly. The person asking is following a process. The business answering is meeting a requirement. Both are doing what is expected, and the result is a stretched system carrying more load every year for a gain that is hard to see.

None of this is an argument against the standards. Cyber resilience and continuity matter, and anyone who relies on a supplier has good reason to ask. The question is whether the asking is aimed at what actually protects anyone, and whether the people meeting it ever hear why.

The Critical Friend

Most businesses can show you the plan they wrote to meet a requirement.

Fewer can tell you when the bar last moved, or what it was moved for.

The question worth sitting with is who the rising standard is actually serving, and whether anyone has said.