Based on what you entered, your ISMS is running one of three failure modes. Each one ends the same way — a suspended certificate and a name on the nonconformity report — but they get there differently, and they implicate different people.

We're not going to guess at this in public. Your diagnosis is specific to your answers, and it isn't pleasant reading.

THE DIAGNOSIS

Your system isn't broken because of a missing control. It's broken because resourcing decisions get made above your authority, and the consequences land below it. When the gap shows up unbudgeted, the board says no — and your name stays attached to the risk register entry that says you knew.

WHAT THIS MEANS

You told us the board denies the resource but holds you accountable anyway. Read that back. You identified the gap. You raised it. You got a no. And the documentation trail — the one you built to protect yourself — now reads as proof you had foreknowledge and no remediation.

The auditor doesn't care whose budget it was. The NC gets written against the ISMS. The ISMS has your name on the Statement of Applicability. At 3 AM, that's the detail that wakes you up — not the gap itself, but who's left holding it when the room goes quiet.

THE CURE

The Collapse Vector Diagnostic traces every denied-resource decision back to the board minute, the email, the meeting where the no was given — and re-documents the chain of custody on that risk so the record shows decision authority, not just disclosure.

We don't fix your security gaps in seven days. We make sure that when the auditor asks "who owned this risk," the paper trail answers with the body that actually had the authority to fund or deny it. Not you.

The audit clock doesn't pause while you decide.

THE DIAGNOSIS

Your ISMS exists. Your policy documents are current, version-controlled, signed off. None of that is the problem. The problem is the distance between what the policy says and what the server logs actually show — and that distance is exactly what a surveillance audit is designed to sample.

WHAT THIS MEANS

You told us a random log pull from yesterday would show undeniable proof IT isn't following policy. Not "minor discrepancy." Undeniable proof.

A certificate is not a system. Documentation is not evidence. The NC gets written against the management system you're accountable for. Your name is on the report that says the controls exist. The log says they don't.

THE CURE

The Collapse Vector Diagnostic samples your environment the way a hostile surveillance auditor would, finds the gaps between stated control and operational reality before they do, and produces documentation that places operational ownership with the function that controls the log — not the function that wrote the policy about it.

Your surveillance audit samples on its own schedule, not yours.

THE DIAGNOSIS

Your access control policy is fine on paper. Your offboarding procedure exists in a document somewhere. The actual revocation depends on a handoff between HR and IT that has no enforced deadline, no system check, and no owner once it leaves your desk — which means the access doesn't actually close. It lingers.

WHAT THIS MEANS

You told us that when someone's terminated unexpectedly on a Friday afternoon, IT gets to it Monday — or HR forgets to tell you at all. There is a window, measured in days, where a terminated employee's credentials are still live.

The auditor doesn't care that HR forgot, or IT was slow. They care that access control failed in practice, on a system you're accountable for, in a gap you already knew existed.

THE CURE

The Collapse Vector Diagnostic maps every handoff point between HR and IT in your termination workflow, identifies exactly where the access window opens and who is structurally responsible for closing it, and produces the escalation documentation that puts that ownership on record — before the audit puts it on you.

The gap closes when the diagnostic does — or an auditor closes it for you, on their terms.