A posture assessment that recommends every control is not an assessment. Some controls are the wrong call for a given organisation, and being able to say so in writing is what makes the rest of the recommendations credible.
The usual candidates
| Control | Reasonable to skip when | Say so because |
|---|---|---|
BIMI | There is no registered trademark, or the brand benefit does not justify an annual certificate | It has no security property. Skipping it costs nothing defensively. |
DNSSEC | The team cannot operate it — no monitoring, no rehearsed key rollover, no recovery for a broken chain | A broken chain is a total outage. Badly operated DNSSEC is worse than none. |
DANE | The MX zone is not yours to sign, or DNSSEC is not yet boring | It fails closed. It should follow DNSSEC competence, not accompany it. |
Registry lock | Beyond the two or three domains whose loss would stop the business | The friction is real and the fee is per domain. |
Defensive registration at scale | Beyond the primary brand in the TLDs customers use | The space is unbounded; the budget buys an arbitrary fraction. |
A monitoring service | Nobody is resourced to work the queue | A queue nobody reads is indistinguishable from no monitoring, and costs money. |
What is never worth skipping
Registrar account security rua on every domain The non-sending record set on parked domains Removing dangling records DMARC to at least quarantine on sending domains All either free or the core of the thing. A report that omits one of these has an error in it, not a judgement call.
How to write it down
A skipped control needs three things recorded: what it would have addressed, why it is not proportionate here, and what would change the decision. The third is what turns an omission into a decision — it says the question was asked and gives the trigger to ask it again.
NOT DOING DNSSEC on the primary domain
WOULD ADDRESS Record tampering and cache poisoning;
also a prerequisite for DANE
WHY NOT No DNSSEC monitoring, no rehearsed key
rollover, and one person who understands it.
An expired RRSIG is a total outage.
REVISIT IF The DNS provider offers fully managed
signing with CDS automation, or a second
engineer is trained.This section is what gets read after an incident
“Not doing this, and why” is examined more closely than anything else in a report when something goes wrong. Recorded, it is a decision somebody made with reasons and a revisit trigger. Absent, it is a gap nobody can account for.