Compliance

Who should approve open source policy exceptions at each company size?

Match exception approval to risk and company size: owner at 10 people, owner plus legal or security at 100, a board for the rare high risk case at scale.

Which vulnerability metrics work as audit evidence?

Auditors look for evidence that a control operated, not a dashboard screenshot. Which vulnerability metrics hold up, and how to keep them reproducible.

Which vendor contract clauses should a first year security program add?

Add incident notice, vulnerability notice and security requirement clauses to vendor contracts, starting with vendors holding customer data or prod access.

Which time zone should audit evidence use, and why does it matter?

Use UTC for stored evidence and note the zone on every file. Timestamps differ by tool and view, and mismatches cause avoidable questions in sampling.

Which security policies does a software company need in year one?

A year one policy set can be short: access, change and review, vulnerability handling, incident response, vendors, acceptable use. Write each in a page.

Which security evidence goes stale fastest during diligence?

Scan results, SBOMs and access lists age in days, while policies age in months. Sort your data room by shelf life and refresh the fast ones on a schedule.

Which open source license policy wins after a merger?

After a merger, neither license policy wins by default. Map licenses by how code is used, normalize identifiers, then set tiers. Not legal advice.

Which license should research software use, and what if it has none?

Code with no license is under exclusive copyright by default. A short guide to MIT versus GPLv3 for research code and the steps to add one.

Which HIPAA technical safeguard does a vulnerable dependency undermine?

Map common dependency flaws to the Security Rule technical safeguards, so your fix tickets and your customer answers speak the same language.

Which dependencies need a BAA: hosted services or libraries?

A library running in your own environment differs from a hosted service that receives PHI. Learn to sort your dependencies before a hospital asks.

Which controls do you inherit from your cloud provider?

Inherited, shared and customer-specific controls explained, plus how to use the provider's own reports as evidence without overclaiming what they cover.

Section 508 or ADA Title II: which accessibility rule fits your buyer?

Section 508 covers federal agencies. ADA Title II web rules cover state and local governments. See which one a school or agency buyer cites, and the dates.