The company — call it Propwash Systems — builds the maintenance-tracking software that a few hundred light-sport fleets rely on, and by its own accounting it had “security” handled: a scanner ran nightly, a monitoring vendor answered the phone, and a quarterly report went to the board. Then a customer’s auditor asked the question that ends complacency: show us who fixed each finding, and when. Propwash’s report had percentages. It had no names. What happened over the next quarter is a case study in SecOps — the operating contract the Ops Atlas describes between security people and operations people, defined through baselines, one owned queue, deadlines, expiring exceptions, and joint metrics, a meaning distinct from the monitoring room and from Google’s product of the same name.
Finding one: SecOps fixes that evaporated
The first audit revelation was arithmetic. Propwash ran its storefront and customer portal in containers, and the operations habit for a critical CVE had been to patch the running containers in place, ticket closed, everyone pleased. The Atlas flags this exact manoeuvre as an anti-pattern: a patched container is a fiction with a lease, because the next redeploy rebuilds it from an unpatched image and the flaw returns, silently. NIST’s SP 800-190 supplies the closure rule that survives redeployment — hand the finding to the image’s owner, and only mark it closed once a rebuilt image scans clean with the old instance nowhere still running. Propwash had closed forty-one findings in a year that its image registry could not confirm. That is not a small miss; that is a scoreboard of washes.
Finding two: the vanishing act in the routing rules
The second discovery was quieter and worse. When the auditors reconciled the scanner’s raw output against the ticket system, twelve findings existed in one and not the other. A well-meaning engineer had been “tidying” the routing rules — the config that decides which team receives which finding — and duplicates were being dropped along with, occasionally, the originals. The Atlas’s trust-boundary teaching covers this precisely: access to scanners, agents operating with root or SYSTEM rights, plus any token a SOAR playbook depends on, all warrant handling identical to a domain-admin credential, because whoever edits routing can make findings vanish without ever touching the underlying system. At Propwash, that power had one holder and no log. Nobody had done anything malicious; the design simply assumed honesty was a control. The remedy was organisational rather than technical: two keyholders instead of one, a recorded change history for the routing configuration, and a standing reconciliation between the scanner’s raw output and the register that the ticket system sees.
Finding three: the SecOps contract that did not exist
Everything traced back to the missing paperwork. Propwash’s two teams were on speaking terms — the problem was never goodwill — but no document said who owned hardening baselines, which timeframes each group had actually agreed to, or which exceptions expired when. Goodwill, the quarter demonstrated, scales badly past about a hundred assets and evaporates entirely during an incident. The contract they wrote in the following month ran one page: baselines borrowed from the CIS Benchmarks rather than invented (the library passes a hundred, in Level 1 and Level 2 grades, with version drift worth pinning — the Atlas documents a case where a v2.0.0 Ubuntu profile met tooling still following 2024’s v1.0.0 content); one register; exceptions with review dates; change windows for security work; and the telemetry duties owed onward to their monitoring vendor, per CIS Control 8’s IG2 list — central collection, synchronised clocks, ninety-day retention, weekly review. Drafting took two afternoons; the argument it prevented during the next incident repaid them by the hour.
The quarter’s numbers, before and after
Analysis is cheap at the whiteboard and expensive in production, so Propwash measured.
- Findings with a named owner: from “not tracked” to a steady 99-plus percent, the residue reviewed weekly.
- Reopens after redeploy: from forty-one unconfirmed closures to zero, once image-rebuild evidence became the only acceptable proof.
- Exceptions past review: five at the audit, one after the first contract cycle.
- Disruption from security changes: two incidents, both from a change that skipped the pilot ring — an honest counter-metric beats a flattering one.
The first monthly reconciliation meeting ran twenty minutes and felt, by one engineer’s notes, “like a weight check before a cross-country — boring in exactly the way you want”. Raw findings in, register entries matched, discrepancies explained on the spot: that single habit would have caught the routing tinkering within a month, and it costs less than the audit that eventually caught it for them. Propwash kept the meeting standing even after the numbers turned green, on the theory that a control you skip when things go well was never really a control. Two practices made it stick: the meeting never moved for release deadlines, and whoever presented discrepancies rotated, so no single narrator ever owned the story of what the data meant.
The board now reads a per-cell scorecard — importance against urgency, on-time percentages, fix-speed medians — instead of a blended percentage, which NIST itself considers not actionable. Readers who maintain their own aircraft will recognise the pattern from this site’s maintenance checklist for light-sport owners: evidence, not memory. The routing question — who signs off, who holds keys — echoes the ownership questions every pilot should ask before buying shares, and the landing-gear discipline in the landing gear checklist is the same philosophy of inspecting what carries the load.
The full reference for the contract model, the container rule, and the trust boundary is the Ops Atlas’s SecOps entry. Propwash’s lesson fits in a line an old inspector would recognise: a signature means the work happened, and paperwork that cannot name a person is decoration.
