What an ODP actually is
Where Rev. 2 might say "review audit logs," a Rev. 3 requirement says the equivalent of "review audit logs [with an organization-defined frequency]." The bracketed value is the ODP. Repeated across the requirement set, that pattern makes Rev. 3 partly a standard and partly a questionnaire, which your program must answer in writing before an assessor answers it for you.
Who sets the value
- The imposing agency, first. Where an agency specifies ODP values (GSA's CUI guidance is the working example; see GSA authorization), those values are binding requirements.
- You, otherwise. Where the instrument is silent, the organization defines the value. That means choosing it deliberately, recording it, and being able to justify it against risk, instead of inheriting whatever the tooling defaulted to.
- Different customers, different values. Serving multiple agencies can mean the same requirement carries different parameter values per customer. A well-kept register handles that (see dual-baseline operations).
The ODP decision register
The artifact that makes ODPs manageable is a register with one row per parameter:
| Column | What goes in it |
|---|---|
| PARAMETER | The requirement and the specific bracketed value it asks for |
| VALUE | The chosen value, per customer where values differ |
| SOURCE | Who set it: agency directive, contract clause, or organizational decision |
| RATIONALE | Why this value is appropriate for your risk and operations |
| IMPLEMENTATION | Where the value is enforced: the Conditional Access policy, Intune profile, or process document that embodies it |
| REVIEW DATE | When the value is next revisited, because values drift out of date without anyone noticing |
The failure modes assessors catch
- The undefended default is a value that exists only because the tool shipped that way. "Why 90 days?" needs a better answer than "it was pre-filled."
- Register-configuration drift is when the register says weekly log review and the SIEM schedule says monthly. One sentence of testing finds this.
- Value collisions across customers happen when you promise one agency a 15-minute session lock and another 30, then enforce one policy tenant-wide. Pick the strictest, or segment deliberately.
- Orphaned parameters are ODPs nobody enumerated, so nobody assigned a value. Generate the register from the requirement set, not from memory.
Register built for you
The ODP register is a deliverable of our Rev. 3 transition.
We enumerate every parameter, assign and source its value, and wire it to the configuration that enforces it, all within a fixed transition scope. Or email rj@indirectit.com directly.