Watch: FBI encourages reporting of cyber incidents, backs legislationStephen WeigandDecember 23, 2021
Audits (External, Internal)Telling a design deficiency apart from an operating deficiencySC Media Editorial Intelligence, reviewed by Joi FrederickOctober 19, 2026
Audits (External, Internal)Rating deficiency severity when you have no severity rubricSC Media Editorial Intelligence, reviewed by Joi FrederickOctober 19, 2026
Audits (External, Internal)Aggregating small deficiencies into one that mattersSC Media Editorial Intelligence, reviewed by Joi FrederickOctober 19, 2026
Audits (External, Internal)Designing a control test that produces defensible evidenceSC Media Editorial Intelligence, reviewed by Jose Figueredo-MasedaOctober 19, 2026
Audits (External, Internal)Choosing a sample size you can defend to an auditorSC Media Editorial Intelligence, reviewed by Jose Figueredo-MasedaOctober 19, 2026
Audits (External, Internal)Setting an Acceptance Period and the Conditions That End It EarlySC Media Editorial Intelligence, reviewed by Steve HutchensOctober 16, 2026
Audits (External, Internal)Testing a Compensating Control on Its Own TermsSC Media Editorial Intelligence, reviewed by Steve HutchensOctober 16, 2026
Audits (External, Internal)Writing a Risk Acceptance Record the Accepting Executive Can SignSC Media Editorial Intelligence, reviewed by Steve HutchensOctober 16, 2026
