Compliance

What usage data does a security tool collect? Questions for edu buyers

Tools collect activity data beyond your files. Learn what metadata is, what the Department of Education says, and five questions for any security vendor.

What do you send a customer who asks about your supply chain security?

What a small vendor can send when a customer asks about supply chain security: a factual summary, an SBOM, evidence and honest limits, with no overclaims.

What can you say on a trust page while SOC 2 or ISO 27001 is in progress?

A trust page can describe controls you run and say an audit is in progress, but must not imply a report or certificate you lack. Sample wording inside.

What should a SOC 2 system description say about third-party code?

Describe how you inventory, review, scan and update third-party libraries in plain, accurate terms. Avoid absolutes and promises your records cannot back.

What should I record when I act on an open source advisory?

Record the advisory, affected versions, your exposure check, the action, owner and dates. A short note turns a patch into evidence an auditor can read.

What should you record when an SBOM search finds nothing?

A zero-hit SBOM search still needs a record: query, scope, SBOM dates, gaps and reviewer. It is the evidence behind any not affected claim you make.

What should you record in your SBOM the day you adopt a library?

On adoption day, capture the library's exact version, source, license, hash and who approved it, so your SBOM answers audit and incident questions later.

What should a cryptographic key inventory record for each key?

A key inventory lists every key, its purpose, owner, location and expiry so you can rotate or revoke fast. The fields to record, with OWASP guidance.

What should engineering hand the GRC team for SSDF questions?

A checklist of what engineering should give compliance when buyers ask about secure development: owners, artifacts, dates and an honest gap list.

What happens when two approvers disagree on a security exception?

Define in advance who has the final say: a named tiebreaker, a risk-based escalation path and a rule that a disagreement defaults to no for high severity.

What should you ask a software vendor about patching before you buy?

Eight patching questions drawn from NIST guidance help a regulated buyer judge a vendor's maintenance habits, and fit a third-party due diligence file.

What does the fine print on the CISA attestation form say?

The CISA form carries an OMB control number, a burden estimate, a Privacy Act note and a false statements warning. What each says, in plain words.