Compliance

What should a yearly audit calendar look like for a small SaaS team?

A simple monthly, quarterly and yearly calendar of evidence tasks, with a named owner for each, so nothing waits for the week before the auditor arrives.

How do you write a security exception renewal request?

A renewal request should show what changed since the first approval, what the exception cost you in risk, and a firm plan to end it. A template.

How do you plan a compliance project backwards from a customer deadline?

Plan SOC 2 or ISO 27001 backwards from the date a customer needs proof: confirm what they accept, then set auditor slots, evidence windows and prep work.

Which words in vulnerability records cause audit findings?

False positive, not applicable, mitigated, accepted: loose words in tickets draw audit questions. Here is what each should mean and what to write instead.

WordPress guideline 7: must plugins ask before contacting outside servers?

The WordPress.org plugin directory requires explicit opt-in consent before a plugin contacts external servers, with data use documented. What that means.

Can a public records request expose a vendor's security documents?

Public bodies can be asked to release records, including documents vendors send. Learn what to mark, what to ask, and why exemptions are not automatic.

Why should SBOM storage be append-only instead of overwritten?

Overwriting an SBOM erases what you told a customer last quarter. Store each version, link it to a release, and keep a clear record of corrections.

Why does architecture review matter for open source license obligations?

A scan lists components, but obligations can depend on how they connect. The TODO guide adds an architecture review of linking and communication.

Who should write the control description: compliance or engineering?

Compliance should draft the control description and engineering should verify it against what actually runs. A two step workflow that avoids fiction.

Who signs the CISA secure software attestation form?

The CISA form asks for the CEO or a designee who is an employee with authority to bind the company. Who qualifies, who does not, and what to prepare first.

Who should sign a SOC 2 management assertion, and what do they need?

The executive who owns the in-scope system signs a SOC 2 management assertion, after building a reasonable basis. Here is what to check and what to expect.

Who should own the trust page and approve its claims?

A trust page needs one named owner, a claims approver, and a review date. Here is a simple ownership model that stops stale or overstated security claims.