Compliance

Who should approve a fleet wide firmware rollout before it starts?

Require a second person with the right permission to review every new or changed rollout before it begins. What to check and what to record.

Who owns open source risk? How to answer the governance question

Customers want a name or a role, not a committee. Learn how to describe ownership, escalation and review of open source risk without overclaiming.

Who do you name as responsible for security if you have no CISO?

Reviewers ask who owns security. How a small company can answer truthfully without a CISO: a named role, a deputy, a reporting line and a review rhythm.

Who answers for an SDK's data in your App Store privacy answers?

Apple's App Privacy details put third-party SDK data collection on the app developer. What that means for your review process and who fills in the answers.

Who does what for SSDF practices when you build on cloud platforms?

NIST says SSDF responsibility may be shared between a platform provider and its tenant. How to write down the split and ask providers to attest.

Who dismissed this finding? Preserving the audit trail in a migration

An imported dismissal that shows the migration account as its author is useless to an auditor. Here is how to keep the real decider and date visible.

Who counts as an independent reviewer for a code change?

An independent reviewer is someone other than the author with authority and context to judge the change. How to enforce that in GitHub and prove it.

Who can accept a risk in ISO 27001? Risk owners and sign-off

In ISO 27001 the risk owner accepts residual risk, with a recorded decision. An IT manager without business authority cannot quietly accept it. Why, below.

Who should approve security evidence before it goes to a customer?

Pre approve a base library, let sales share it freely, and route anything custom or sensitive to security for review. A short RACI keeps it fast and safe.

Who should approve open source policy exceptions at each company size?

Match exception approval to risk and company size: owner at 10 people, owner plus legal or security at 100, a board for the rare high risk case at scale.

Which vulnerability metrics work as audit evidence?

Auditors look for evidence that a control operated, not a dashboard screenshot. Which vulnerability metrics hold up, and how to keep them reproducible.

Which vendor contract clauses should a first year security program add?

Add incident notice, vulnerability notice and security requirement clauses to vendor contracts, starting with vendors holding customer data or prod access.