The reasoning used to interpret evidence, uncertainty, scope, and context before reaching a defensible third-party risk conclusion.
Validation
+3
Sep 16, 2026
•
2 min read
A vendor extension request made me question why evidence-based assessments so often begin with another round of manual questionnaire work.
Data Flow
+2
Sep 9, 2026
No system connection doesn’t mean no data flow. Sometimes the path to the vendor runs through the people using the service.
Assessment Judgement
Sep 2, 2026
A different company name can be a clue, but the assessment still has to establish which entity owns the service and control environment.
+4
Sep 1, 2026
3 min read
I built a validator to see how much of the evidence review can be assisted while keeping the assessment decision with the assessor.
Aug 26, 2026
A completed questionnaire tells you what the third party says is true. Validation determines what you can actually stand behind.
Aug 19, 2026
A deployment label can tell you where software runs without telling you what the service can access, capture, store, or transmit.
Aug 12, 2026
Evidence quality matters. Evidence relevance matters more.