Compliance

What does NIST 800-53 CM-3 mean for dependency updates?

CM-3 asks you to define controlled change types, review security impact, document decisions and keep records. What that means for dependency updates.

What must a vendor publish after a vulnerability is fixed?

What a software vendor should publish once a fix ships: description, affected products, impact, severity and remediation steps, per EU CRA Annex I.

What must a Regulation S-P breach notice to customers say?

Amended Regulation S-P sets what a customer breach notice must include and a 30-day limit from awareness. The required content and what engineers supply.

How should you organise a security folder in a diligence data room?

Use numbered folders, an index with dates and owners, consistent file names and a short readme. Make the first ten minutes of a reviewer's visit easy.

What does machine readable customer notification mean for a vendor?

The EU CRA says to inform users, where appropriate in a structured, machine readable format. What that means in practice with CSAF, VEX and CycloneDX.

What does ISO 27001 expect from top management? Clause 5 explained

ISO 27001 clause 5 expects top management to show commitment, set the security policy and assign roles. Here is what auditors look for and how to prove it.

What is the NDPA and why do school districts ask vendors to sign it?

The National Data Privacy Agreement is a shared contract template for student data. Learn what it is for, what the registry does, and how vendors prepare.

What is OpenChain ISO/IEC 5230, and should a startup care?

ISO/IEC 5230 is a standard for open source license compliance programs. Startups can use it as a checklist without seeking certification. Here is how.

What is NIST SP 800-218A and does it cover AI-written code?

NIST SP 800-218A extends the SSDF for generative AI model development. It is about building models, not code an assistant writes. What to use instead.

What is GRC engineering and what does the role actually do?

GRC engineering applies software practice to governance, risk and compliance: controls as code, automated evidence and tests. What the role does daily.

What is an OpenRAIL license, and can you use the model commercially?

OpenRAIL licenses allow open access and redistribution but add use-based restrictions that pass to derivatives. What to read before you ship one.

What is an open source review board and who sits on it?

An open source review board (OSRB) reviews open source use and release for license and security risk. Who sits on it, what it decides, how to keep it fast.