The AV control system shows the boardroom green. The codec is online, the displays are awake, the audio is passing. Then the CISO walks in and asks how the room is secured, and the control surface has nothing to offer. Operational status and security evidence answer different questions, and auditors stopped accepting the first as the second a long time ago.
What the control surface is for.
Crestron, Extron, Q-SYS, Poly by HP and Neat control systems are excellent at the job they were built for. They run the room. They confirm the codec is reachable, the camera is live, the displays are up, the microphone is in range and the meeting can start. When something stops working, they tell the operations team where to look first.
That is operations data. The control surface watches the room work. It has no view of the network the room sits on, and no way to know whether the device on a given port is the one installed there last quarter.
Three things "all green" does not prove.
A green status on the control system means three things, and the auditor and the CISO are asking about none of them.
- The device is reachable. Reachable and authentic are separate properties. A device that responds on the expected IP can be a substitute, an impostor, or a known asset whose firmware was tampered with before it ever reached the install.
- The room is functional. A room can work perfectly and still be exposed. The meeting runs fine while the network drop behind the codec also hosts an unmanaged switch with four contractor laptops on it. The control surface only sees the codec.
- The asset is registered. Registration says somebody bought it. The asset register lists purchases and the wire shows what is plugged in. Those are different lists, and the gap between them is where audit findings live.
The supply-chain implant case.
A global enterprise rolled out hundreds of identical conference kits across its sites. Procurement records were complete. Serial numbers matched. Software validation cleared every device, and every control system reported green.
CybrIQ flagged one camera in the fleet whose electrical fingerprint did not match the rest. On every check the higher-layer tools were designed to run, it looked identical to the others. The camera was a supply-chain implant, modified upstream of the install and built to capture more than meeting minutes. Without physical-layer validation it would have stayed in the room for years.
Everything above Layer 1 said the camera was fine. The wire said otherwise.
What the auditor is asking for.
Audit frameworks have moved past "trust the operator's attestation." HIPAA, PCI, SOC 2, NIST CSF and CMMC each require, in their own language, evidence that the inventory is verifiably current and that controls were enforced continuously over the audit period.
The evidence that meets that bar is a per-device, per-port, dated record: what was connected to which switch port, when, and how its identity was verified. Control systems were never designed to produce it. It was never their job.
The board, the carrier and the regulator.
The same gap shows up in every executive conversation about security posture. The board wants assurance. The cyber-insurance carrier wants inputs for its risk model, and the regulator wants control evidence. Each wants the same artifact in its own shape: what is on the network, and how do you know?
A continuous Layer 1 record answers that. CybrIQ's per-device, per-port history is structured for an audit to take at face value. The board version reads in five minutes, and the carrier gets it machine-readable.
The control surface tells you the room is working. The Layer 1 record tells you what is connected to it. The industry solved the first question a decade ago, and the second is the one the audit, the board and the carrier keep asking.
Further reading
- The asset register lies. Why the register is wrong on the day it is written, and why it never catches up by itself.
- Five reports, one truth. One record, five frameworks, and the controls each one cites.
Bring the room. We will produce the evidence.
A 30-minute working session against one of your conference rooms. You leave with a dated per-device record that comes straight from the wire.