Twelve months on, the question is not whether the controls are deployed. It is whether the organisation notices when one of them stops working — which is a different property and the only one that survives the person who built it.
What is true
| Day 0 | Day 365 | |
|---|---|---|
| Registrar account | Shared login, no MFA, no lock | Individual logins, MFA, transfer lock; registry lock on two domains |
| Primary domain | p=none, reports unread | p=reject, reports read weekly by a named person |
| Marketing domain | Not resolving for validating resolvers | Resolving; unsigned by decision, with the reasoning recorded |
| Parked domains | Six completely open, two able to receive mail | Six locked down with the full non-sending set |
| Country domains | Uncontrolled | Recovered, or on a documented track with an owner |
| Dangling records | At least one, unknown total | None, and offboarding includes a DNS step |
| Lookalikes | Five, one operational, none detected by us | Detected within hours; a queue that is worked and closed |
How you would know it is working
- Something broke and was caught by a check rather than by a customer. That is the single best indicator, and it will have happened at least once — a vendor grew an SPF include, or a certificate nearly expired.
- A new domain was registered and entered the estate correctly, with the non-sending set, on day one, without anyone escalating.
- A vendor was offboarded and its selector and include went with it.
- Somebody other than you answered a question about the estate from the handover document.
- The lookalike queue is worked and closed, in single figures per week, with recorded closure reasons.
How you would know it is not
The alerts are muted. Nobody remembers when. A domain was registered in March and nobody applied the record set, because the person who would have done it was not asked. The lookalike queue has 340 items and the last closure was in June. The handover document is eight months out of date. The pass rate is fine and nobody has looked at which sources it is fine for.
Every one of those is a programme that deployed everything correctly and stopped being operated. The controls are still published; the property that made them worth having is gone.
Reassess with the same method
The point of a repeatable assessment is that year two is a diff rather than a project. Run the same sequence, produce the same table, and compare — and the comparison tells you what decayed, which is the finding that matters most at this stage.