Capability Debt

Nobody checks the spare. It rides under the boot floor for years, slowly going soft in the dark, while the car above it is serviced on schedule. The day it is needed is the first day anyone has needed it. On the hard shoulder, the owner finds out what they have been carrying: not a spare tyre. The memory of one.

Nothing about the spare announced the change. It sat there looking exactly like readiness.

Ownership has a paper trail. The invoice, the delivery date, the line on the asset register. Readiness has almost none. The register records the day each thing arrived; no line anywhere records the last day it was proven to work. An organisation reads the first date and calls it capability.

The word for the gap between owned and proven is debt, and it behaves like one. Across incidents the same sequence repeats. The backups ran nightly for six years; the first full restore was attempted the week of the ransomware. The backup held. The restoring did not: the order the systems come back in had lived in the head of an engineer two jobs gone, and the runbook named servers retired in the meantime. Nothing was lost on the day the engineer left, or the day the servers changed. The price of the unrun exercise rose quietly both times. That is what makes it debt rather than decay: every deferred proof makes the eventual proof more expensive.

The crisis plan is in the drawer, approved by everyone senior, dated the month after the last crisis, and not since.

The certificate on the office wall says someone here can do CPR. The certificate is six years old. The wall cannot say what those hands can do today.

Some designs admit all of this. The smoke alarm carries a test button because installed and working are different claims with different dates. A first aid certificate expires after three years, because the card outlasts the practice. A pilot’s licence does not carry passengers by itself; recent take-offs and landings do.

The gates tell the same story the friction told. Every one of them stands in front of the buying. None stands in front of the proving. Three signatures acquired the platform; nobody has ever signed to say the restore works.

Until it is exercised, a security stack is a list of things the organisation believes it can do.

Readiness has a date.

Capability is a practice.

Pick the capability your organisation is surest of.

The question is: when was it last exercised, by the people still here, against the system as it runs today?