Tag
Vulnerability Management
6 articles
Compliance frameworks
ASV scans: what passes and what fails
PCI DSS requires a passing external scan from an Approved Scanning Vendor every quarter. How scope is set, what fails a scan, and how to dispute a finding.
6 min read
Trust and sales
Sharing penetration test results with buyers
What buyers want from your penetration test, what a summary letter should contain, how to discuss open findings honestly, and when to share more detail.
6 min read
Compliance frameworks
DORA resilience testing and TLPT
What DORA's testing program requires every year, which entities must run threat-led penetration tests, who may test, and what ICT providers must do.
6 min read
Security engineering
Patch management evidence
"Show us systems are patched" is a hard request when assets differ. The evidence that holds up for laptops, servers, containers and managed services, over time.
6 min read
Compliance frameworks
Continuous monitoring under NIST 800-53
What NIST 800-53 control CA-7 requires, how to set monitoring frequencies, which controls feed it, and how monitoring results turn into risk decisions.
5 min read
Security engineering
Vulnerability management SLAs auditors accept
Auditors test whether you met your own remediation windows. How to set severity tiers and SLAs you can keep, handle exceptions, and evidence every finding.
6 min read