Paste the scheduler export. Get every job against the clock a rule sets.
Paste your scheduled jobs and reports, the way your scheduler exports them. Get every job classified by what consumes it, the clock a rule puts on that consumer with the clause behind it, the gap between the job's schedule and that clock, the jobs with no owner and no fallback, the duplicates, and the list to take to the owners before the next audit asks how often the evidence is actually produced.
| Job | Period | Clock | Gap |
|---|---|---|---|
| card_env_log_review slow | 168h | 24h | 144 h168 h / 24 h |
| siem_log_review_export log daily | 730h | 24h | 706 h730 h / 24 h |
| prod_db_full_backup no restore | 24h | no clock | no clock |
| gdpr_breach_report_pack no drill | no period | 72h | no period72 h clock |
| quarterly_access_review_export slow | 8,760h | 4,380h | 4,380 h8,760 h / 4,380 h |
| vuln_scan_export scan | 4,380h | 2,190h | 2,190 h4,380 h / 2,190 h |
| customer_statement_feed | 1h | no clock | no clock |
| halden_widget_warmer unreg | 1h | not placed | not placed |
| 36 jobs, 35 classified | 5 slower | 30 clauses | 11 findings |
Paste the jobs you already schedule
The scheduler's export, the report calendar, the cron table or a line per job from memory: one job per line with its schedule, and where you have them the source, the consumer, the owner and the fallback, in any order the header names. Every job is matched against a published dictionary of 47 consumer classes in ten families; a job that matches nothing is marked unrecognised and never guessed.
Read the period, the clock and the gap
Per job: the class and its family, the period read from the schedule in hours and words, the shortest clock the ticked rules put on that consumer with the clause that states it, and the gap between the two. Where a text says periodically, regularly or a defined frequency, the row says so and carries no hours; the register never fills a blank the standard left open. Per register: jobs by family, by period band and by owner, and how many sit on a fixed clock.
Take the findings and the questions to the owners
Eleven findings in a fixed order: the unrecognised job, the schedule slower than its clock, the on-demand job where the clock is fixed, no owner, no fallback, the backup with no restore test beside it, the log review outside the daily read, the breach pack with no drill, the duplicate, the concentration on one owner or one source, and the scan slower than quarterly. Every classified job carries one question for its owner; the owner list groups them by the person they go to.
Why a register and not a control list
A control list says what should exist. A scheduler export says what actually runs and how often, and the two are different objects. When the auditor asks how often the card-environment logs are reviewed, the answer is not in the policy; it is the schedule of the job that produces the review. Read against the clause, that schedule is a finding: the log review job runs weekly against a daily clock. Batch Register reads that gap job by job from the export you already hold, in your browser, and never says a control is present or absent.