Compliance

How should you organise a security folder in a diligence data room?

Use numbered folders, an index with dates and owners, consistent file names and a short readme. Make the first ten minutes of a reviewer's visit easy.

What does machine readable customer notification mean for a vendor?

The EU CRA says to inform users, where appropriate in a structured, machine readable format. What that means in practice with CSAF, VEX and CycloneDX.

What does ISO 27001 expect from top management? Clause 5 explained

ISO 27001 clause 5 expects top management to show commitment, set the security policy and assign roles. Here is what auditors look for and how to prove it.

What is the NDPA and why do school districts ask vendors to sign it?

The National Data Privacy Agreement is a shared contract template for student data. Learn what it is for, what the registry does, and how vendors prepare.

What is OpenChain ISO/IEC 5230, and should a startup care?

ISO/IEC 5230 is a standard for open source license compliance programs. Startups can use it as a checklist without seeking certification. Here is how.

What is NIST SP 800-218A and does it cover AI-written code?

NIST SP 800-218A extends the SSDF for generative AI model development. It is about building models, not code an assistant writes. What to use instead.

What is GRC engineering and what does the role actually do?

GRC engineering applies software practice to governance, risk and compliance: controls as code, automated evidence and tests. What the role does daily.

What is an OpenRAIL license, and can you use the model commercially?

OpenRAIL licenses allow open access and redistribution but add use-based restrictions that pass to derivatives. What to read before you ship one.

What is an open source review board and who sits on it?

An open source review board (OSRB) reviews open source use and release for license and security risk. Who sits on it, what it decides, how to keep it fast.

What is an ACR (VPAT) and why do public buyers ask for one?

An ACR is a vendor-written report on how software meets accessibility standards. Here is what it contains, how buyers use it, and what it cannot prove.

What is a vendor security assessment, and how is it not an audit?

A vendor security assessment is a buyer's review of your controls, often by questionnaire. An audit is an independent examination. Here is how they differ.

What is a SOC 2 management assertion and who writes it?

A SOC 2 management assertion is management's signed statement that the system description is fair and the controls meet the criteria. Here is how it works.