Compliance

Which time zone should audit evidence use, and why does it matter?

Use UTC for stored evidence and note the zone on every file. Timestamps differ by tool and view, and mismatches cause avoidable questions in sampling.

Which security policies does a software company need in year one?

A year one policy set can be short: access, change and review, vulnerability handling, incident response, vendors, acceptable use. Write each in a page.

Which security evidence goes stale fastest during diligence?

Scan results, SBOMs and access lists age in days, while policies age in months. Sort your data room by shelf life and refresh the fast ones on a schedule.

Which open source license policy wins after a merger?

After a merger, neither license policy wins by default. Map licenses by how code is used, normalize identifiers, then set tiers. Not legal advice.

Which license should research software use, and what if it has none?

Code with no license is under exclusive copyright by default. A short guide to MIT versus GPLv3 for research code and the steps to add one.

Which HIPAA technical safeguard does a vulnerable dependency undermine?

Map common dependency flaws to the Security Rule technical safeguards, so your fix tickets and your customer answers speak the same language.

Which dependencies need a BAA: hosted services or libraries?

A library running in your own environment differs from a hosted service that receives PHI. Learn to sort your dependencies before a hospital asks.

Which controls do you inherit from your cloud provider?

Inherited, shared and customer-specific controls explained, plus how to use the provider's own reports as evidence without overclaiming what they cover.

Section 508 or ADA Title II: which accessibility rule fits your buyer?

Section 508 covers federal agencies. ADA Title II web rules cover state and local governments. See which one a school or agency buyer cites, and the dates.

Where does a SaaS vendor keep your backups and failover copies?

Primary region is only part of data location. Ask about backups, replicas, failover regions and logs, and get the full list of countries in writing.

When in a sales cycle should you share which security evidence?

Share public material early, a summary pack at evaluation, detailed evidence after confidentiality terms, and customer specific packs near signature.

What was 'critical software' in the federal attestation rules?

EO 14028 defined critical software by privilege, access and potential harm, and M-22-18 set earlier attestation deadlines for it. What that meant for you.