Run a quarterly control review in about ninety minutes with product security, platform and compliance together. Walk through each control owner's confirmation, sample a few pieces of evidence, review expiring exceptions and agree the actions for the next quarter. It finds drift while it is still cheap to fix.
Why quarterly
An annual review finds problems after a year of drift. A weekly one is too frequent for control level questions. Quarterly sits between: often enough to catch a replaced tool or a changed process, rare enough to stay useful. NIST CSF 2.0 outcome GV.OV-03 refers to evaluating organizational cybersecurity risk management performance, and a dated review each quarter produces a record of that evaluation.
Before the meeting
Compliance sends each control owner a short form one week ahead.
- Does the control description still match what runs?
- Has the system, tool or owner changed this quarter?
- Are there any known gaps or exceptions?
- Where is the evidence for the period?
Owners who answer "nothing changed" do not need to attend. Owners with changes do.
The agenda
| Minutes | Item | Output |
|---|---|---|
| 10 | Review shared numbers and last quarter's actions | Closed or carried over |
| 25 | Controls with changes or gaps | Fix, change description, or accept with expiry |
| 20 | Evidence sampling | Two or three items traced from source to record |
| 15 | Exceptions expiring in the next 60 days | Renew with reason, or fix |
| 10 | Platform and tooling changes planned | Control impact noted |
| 10 | Actions and owners | Written list with dates |
Sample like an auditor
Pick a few items at random and trace each from its source system to the stored record. This takes minutes and reveals the gaps an auditor would find later: missing approvals, expired logs, mismatched dates. NIST SSDF task PO.4.2 suggests protecting gathered information from alteration or deletion, so check that the stored copy still matches the source.
Record the meeting
Keep a one page record: date, attendees, controls reviewed, changes found, actions with owners. Store it with the evidence register so an auditor can see a pattern of regular review.
Common mistakes
Reviewing every control every time is exhausting. Review by exception: only controls with changes, gaps or sampling hits. Rotate a deeper review across the full list over the year so each control gets a thorough look once.
Try it yourself
Click through it at your own pace, or open it full screen. See how controls link to evidence, which is what the review samples.
Where Safeguard fits
Safeguard includes compliance and evidence automation, giving the review current records to sample. A free scan shows sample output.
Quick check
Do we need everyone in the room?
Only owners with changes or gaps, plus one person from each of the three teams. Others can send written confirmation.
Does a review count as an audit?
No. It is an internal check. It helps you prepare, but it does not replace an independent assessment.
Sources
- NIST Cybersecurity Framework 2.0, outcome GV.OV-03.
- NIST SP 800-218, Secure Software Development Framework 1.1, task PO.4.2.
Last reviewed: 19 October 2026.
