Assessment Judgement

The reasoning used to interpret evidence, uncertainty, scope, and context before reaching a defensible third-party risk conclusion.

Vendor Activity

+3

Sometimes the Missing Answer Is Internal

Nov 4, 2026

•

2 min read

Sometimes the Missing Answer Is Internal

Not every unanswered assessment question belongs to the vendor. Sometimes the customer is the authoritative source for whether a third-party relationship actually exists.

Shahla Mammadova Alyasiry

Questionnaire

+3

Start With the AI Use Case

Oct 28, 2026

•

2 min read

Start With the AI Use Case

A vendor may have AI across its product portfolio, but the assessment should start with the specific AI functionality actually being used in the relationship.

Shahla Mammadova Alyasiry

Questionnaire

+3

When “Not Applicable” Needs a Second Look

Oct 7, 2026

•

2 min read

When “Not Applicable” Needs a Second Look

A question may not fit the vendor’s environment, but that does not always mean the underlying control responsibility disappears.

Shahla Mammadova Alyasiry

Validation

+3

When The Policy And The Evidence Disagree

Sep 30, 2026

•

2 min read

When The Policy And The Evidence Disagree

A policy may establish what should happen. When operating evidence shows that it didn’t, the assessment has to go further.

Shahla Mammadova Alyasiry

Validation

+3

Why Start With the Questionnaire?

Sep 16, 2026

•

2 min read

Why Start With the Questionnaire?

A vendor extension request made me question why evidence-based assessments so often begin with another round of manual questionnaire work.

Shahla Mammadova Alyasiry

Data Flow

+2

How Data Reaches a Vendor Without an Integration

Sep 9, 2026

•

2 min read

How Data Reaches a Vendor Without an Integration

No system connection doesn’t mean no data flow. Sometimes the path to the vendor runs through the people using the service.

Shahla Mammadova Alyasiry

Assessment Judgement

+2

Which Entity Does The Assessment Belong To?

Sep 2, 2026

•

2 min read

Which Entity Does The Assessment Belong To?

A different company name can be a clue, but the assessment still has to establish which entity owns the service and control environment.

Shahla Mammadova Alyasiry

Validation

+4

Why I built a vendor evidence validator

Sep 1, 2026

•

3 min read

Why I built a vendor evidence validator

I built a validator to see how much of the evidence review can be assisted while keeping the assessment decision with the assessor.

Shahla Mammadova Alyasiry

Validation

+3

The Questionnaire Is a Claim, Not Proof

Aug 26, 2026

•

2 min read

The Questionnaire Is a Claim, Not Proof

A completed questionnaire tells you what the third party says is true. Validation determines what you can actually stand behind.

Shahla Mammadova Alyasiry

Data Flow

+2

What Are We Actually Assessing?

Aug 19, 2026

•

2 min read

What Are We Actually Assessing?

A deployment label can tell you where software runs without telling you what the service can access, capture, store, or transmit.

Shahla Mammadova Alyasiry

Validation

+4

When Good Evidence Answers the Wrong Question

Aug 12, 2026

•

2 min read

When Good Evidence Answers the Wrong Question

Evidence quality matters. Evidence relevance matters more.

Shahla Mammadova Alyasiry