A quarterly review should cover five things: what changed in the inventory, which exceptions expire, where tooling gaps remain, what a sample check found, and which decisions to record. Ninety minutes is enough if the data is ready in advance. The goal is to catch slow drift that weekly work misses.
Before the meeting
Someone prepares four pages from the shared data, one for each of the first four agenda items. Send them a day early. Meetings that start with "let me pull that up" run long and decide little.
The agenda
| Time | Item | Output |
|---|---|---|
| 15 min | Inventory drift | New repos, new languages, repos with no owner |
| 20 min | Exceptions | Renew, fix or close each expiring exception |
| 20 min | Tooling gaps | One investment to make this quarter |
| 20 min | Sample check | Two repos verified by hand |
| 15 min | Decisions | A short written list |
Inventory drift
Compare this quarter's list of manifests and lockfiles to last quarter's. New ecosystems are the key item. Each one should have gone through the onboarding checklist. Repos with no owner go straight to the escalation owner.
Exceptions
Every exception has an expiry date. Review those expiring in the next quarter. For each, decide: fixed, renewed with a reason, or escalated. Renewals should be rare and explained. A long list of renewals means the rule is wrong or the work is unfunded.
Tooling gaps
Pick the weakest ecosystem in your table: the one with the fewest yeses on the scorecard, or the weakest audit data. Choose one improvement. For example, enable locked mode in CI where it is missing, turn on a hash check, or add SBOM output.
Sample check
Pick two repos at random, ideally in different languages. Verify the answers on the scorecard directly: open the CI config, look at the install command, check the lock diff history. This is how you catch a lock file CI never reads.
Decisions
End with a short written list: what was decided, who owns it, and when it is due. Post it where teams will see it.
What not to cover
Skip individual vulnerability triage. That belongs in the weekly routine. Skip tool brand debates. Keep the meeting about controls, ownership and gaps.
Measures worth reviewing
- How many repos meet each scorecard question, as a count, not a percentage average.
- How many exceptions exist and how many are overdue.
- How many repos have no named owner.
Report counts and the worst cases. Averages hide them.
Safeguard can help here: it scans dependencies and generates SBOMs, applies reachability analysis so you can sort findings by what your code can actually call, and enforces policies and gates on pull requests. You can try a free scan on a repository to see what it finds.
Quick check
Is a quarterly review too slow?
It complements the weekly routine. Weekly handles individual updates, quarterly catches drift in controls, ownership and tooling.
Who should attend?
A representative from each language group, the platform or security group, and the escalation owner.
Last reviewed: 19 October 2026.
