Key ceremonies that can be repeated

The single-ceremony trap

The initial ceremony is run at go-live by the engineers who built the system, with the vendor present and everyone concentrating. It succeeds. Eighteen months later a key must be rotated, none of those people are available, and the document written for the first ceremony turns out to have been a record of what happened rather than a procedure for making it happen again.

Writing for the second performance

• Name roles, not peopleEvery step is assigned to a role the institution still has. A step assigned to a named individual is a step that expires.
• State the preconditionsHardware, room, witnesses, and what to do when one is unavailable — which is the situation the procedure will actually be run in.
• Include the abort pathWhat happens if a step fails halfway. Ceremonies without an abort path get improvised, under time pressure, with keys on the table.

Rehearsal cadence

Twice a year, on staging, with whoever is on the rota that month rather than the people who know it best. The measure of the document is whether that group can complete it unaided; if they cannot, the document is wrong and the system is one resignation from an incident.

The record

Each ceremony produces a signed record of who was present, which steps executed, and any deviation. That record is what an auditor reads, and it is also what tells you whether the procedure has drifted from the document — which it will, and which is fine as long as the document is updated rather than the deviation repeated.