Run a 60 minute quarterly review with a fixed agenda: confirm the population, sample deferrals, re-check not reachable decisions, review exploited items, update exceptions and record outcomes. The meeting itself is the control. Its minutes, attendee list and changed records are the evidence an auditor will sample.
Why a meeting counts as a control
Policies say deferred findings are reviewed. An auditor wants to see that a review happened, who attended, what they looked at and what changed. A recurring meeting with minutes provides all four. Without it, "we review regularly" is a statement with nothing under it.
Before the meeting
Circulate a pack two days ahead.
- The finding population by class, taken from one pinned export with a date.
- Deferrals due or overdue for review.
- Items whose advisory or exploitation status changed since last time.
- Exceptions expiring in the next quarter.
Pinning the export matters. If the numbers move during the meeting, nobody can compare them later.
The 60 minute agenda
| Minutes | Item | Output |
|---|---|---|
| 5 | Confirm attendees and the pinned population | Attendance record |
| 10 | Review exploited in the wild items and time to decision | Actions with owners |
| 15 | Re-check a sample of not reachable decisions against current builds | Confirmed or reopened |
| 10 | Review unknown results | Owners assigned |
| 10 | Review expiring and overdue exceptions | Renewed with reason or closed |
| 5 | Policy changes and tooling changes | Logged |
| 5 | Confirm actions and next date | Minutes issued |
For the sample, choose with a method you can describe, such as every tenth item or all items above a severity, and note it. NIST's Secure Software Development Framework describes updating records of risk responses and approved exceptions as needed, which is what the renewal step does.
What to record in the minutes
- Date, attendees and roles.
- The pinned export reference.
- The sampling method and the items reviewed.
- Each decision: confirmed, reopened, renewed or closed.
- Actions, owners and due dates.
- Any disagreement, with both positions.
Keep minutes short. One page is enough.
Make the follow through visible
Link every action to a ticket. At the next review, begin with last quarter's actions. Open actions with no explanation are a classic audit finding.
Include a reality check on the method
Once a year, add an item that tests the analysis itself, such as comparing a few reachability results with a manual read of the code. Note what you found. Admitting a miss in the minutes shows the review has teeth.
See also when to re-run reachability analysis.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how status changes surface between reviews.
Quick check
Is a quarterly review enough?
It depends on your policy and risk. Exploited items and new advisories should be handled as they arrive, not held for the meeting.
Who should attend?
A security owner, an engineering representative who can reclassify and someone who can approve exceptions.
Safeguard offers continuous monitoring, reachability analysis and evidence automation that supply the pack for a review like this. You can try the free scan.
Sources
Last reviewed: 19 October 2026.
