Compliance

What happens when two approvers disagree on a security exception?

Define in advance who has the final say: a named tiebreaker, a risk-based escalation path and a rule that a disagreement defaults to no for high severity.

What should you ask a software vendor about patching before you buy?

Eight patching questions drawn from NIST guidance help a regulated buyer judge a vendor's maintenance habits, and fit a third-party due diligence file.

What does the fine print on the CISA attestation form say?

The CISA form carries an OMB control number, a burden estimate, a Privacy Act note and a false statements warning. What each says, in plain words.

What should a board or senior officer see about vulnerability management?

Governance rules expect written reports to senior leaders. What a vulnerability section should say, how often, and what questions leaders should ask back.

What should RPA audit logs record, and what must they never hold?

RPA logs should tie every action to a bot, version, owner and time, and never hold passwords or raw personal data. Here is a field list that works.

What should an ML-BOM include for a model you ship?

An ML-BOM records a model, its datasets, its dependencies and configuration. Here is a practical field list for the model you ship to customers.

What should a written vulnerability management policy cover?

A regulated-industry vulnerability management policy should name scope, scan cadence, prioritization, remediation timelines, exceptions and evidence.

What should a startup vendor register include for a supply chain review?

The fields a small SaaS or ecommerce vendor register needs to answer customer supply chain questions: data access, code access, owner and review date.

What should a change ticket contain? Fields auditors look for

A change ticket needs a requester, description, risk, approval, test result, deploy time and rollback plan. A short field list that people will fill in.

What proves management commitment to secure development (SSDF PO.2.3)?

SSDF PO.2.3 asks for leadership commitment to secure development. Learn what artifacts show it without turning it into a slogan or a signed poster.

What does 'prior to release' mean for continuously deployed SaaS?

The CISA form wants vulnerability checks on an ongoing basis and before each release. For SaaS that deploys many times a day, here is a practical reading.

What patch evidence should you keep for OS and dependency updates?

Keep a dated record of what was vulnerable, what changed, when it ran in production and who approved it. Here is the evidence for each layer.