◆
Evidence is not a project
The record exists because the work was done. Nobody assembles it afterwards from memory and inference.
Compliance is expensive mostly because evidence is assembled after the fact by people reconstructing what happened. Produce it as a by-product and the cost largely disappears.
Used for audit readiness, access governance, change control and policy enforcement.
What this looks like in practice
The record exists because the work was done. Nobody assembles it afterwards from memory and inference.
Who could reach what, and who did. The question that usually takes a week.
Policy enforced by how the system is arranged rather than by people remembering it.
What is kept and what is deleted, enforced rather than intended.
The cost of compliance in most organisations is not the controls. It is proving the controls were in effect, after the fact, to someone sceptical.
The usual pattern is a quarter of preparation, a freeze, and a team diverted entirely to answering questions. When the evidence is already there, the audit becomes a series of lookups that one person handles while everybody else keeps building.
Certification from the actual access record rather than a spreadsheet assembled by hand.
The approval record kept automatically, so control does not mean delay.
Configuration enforced rather than described in a document and audited against hopefully.
Retention and deletion obligations enforced on schedule without someone remembering.
Our last audit took one person eight days. The one before it took four people most of a quarter.
The underlying evidence — change history, access records, configuration state, retention — is what most frameworks ask for in different language. Tell us which you are audited against and we will be specific about what we do and do not cover.
Generally no, because the evidence is not being assembled while the auditors are present. That alone is usually the largest saving.
For the period you configure, enforced rather than intended. Retention that depends on someone remembering is the most common quiet failure here.
Yes — who could reach what, and who did, as a query. In most organisations that is a week of work, which is why it is rarely asked until an auditor asks it.
Start on something that will still be right at a hundred times your size, and pay now what a startup should pay.
Move in stages with the old arrangement still running, and cut over only once the replacement has carried real traffic.
Get capacity when the experiment is ready, keep what produced a result, and put models in front of users without a separate platform.
Keep everything at full fidelity, query it without a project, and stop deciding today what you will want to ask next year.
Ship the application your users touch, on an address that stays put, with every version one click behind you.
Build the tools your own teams need, at a cost that makes small improvements worth doing.
Begin with one workload. Keep what you have running. Decide whether to continue once you have seen it carry something real.
No migration required to begin. Nothing to tear down if you stop.