How does pursuing a certification change how you design, beyond adding controls?

What is being tested

Whether you see scope and evidence as architectural decisions rather than as process ones.

Scope becomes an architectural lever

Everything in scope must be controlled, evidenced and audited — annually, forever. So reducing scope is worth more than any control applied to a wider surface.

Concretely: if regulated data can be confined to a small, well-defined subsystem — or kept out entirely, as with tokenising card data at the edge so card numbers never enter your systems — the audit surface reduces by an order of magnitude.

And the scope boundary must be a technical boundary, not a documentary one. A scope that does not correspond to an account, a network or a cluster cannot be demonstrated convincingly and will be challenged.

That is a design decision made early, and it is very expensive to retrofit.

Evidence becomes a design requirement

Auditors need proof a control operated throughout the period.

Manual evidence — screenshots, spreadsheets, exported lists — consumes engineering time every year forever, and it scales with the estate. Automatic evidence, emitted as a side effect of normal operation, turns the audit into an export.

Designing for that means: structured logging of control operations, immutable audit storage, access reviews driven from a system of record rather than from memory, and deployment records that capture approvals and test results.

Controls belong in the platform

If controls live in the paved road, using the standard pipeline makes a service compliant by construction — and the assurance question becomes "is this service on the paved road", which is mechanically answerable.

Where each team implements controls independently, each team is separately audited and separately fails.

The controls that become architectural requirements

Access control with periodic review, which requires knowing who has access to what — harder than it sounds. Change management with evidence, increasingly satisfied by an automated pipeline. Logging with retention, tamper-evident. Encryption with key management. Backup with tested restore. And an asset inventory, which is a prerequisite for almost everything else.

The caution

Certification is not security. They overlap substantially and are not the same thing, and a programme that optimises for the certificate rather than for the outcome will pass an audit and be compromised anyway.