Observations about what is actually in scope today versus what prior records, contracts, or assumptions suggest.
Assessment History
+3
Sep 23, 2026
•
2 min read
An acquisition may change who owns the company without changing what the previous assessment actually covered.
Data Flow
+2
Sep 9, 2026
No system connection doesn’t mean no data flow. Sometimes the path to the vendor runs through the people using the service.
Assessment Judgement
Sep 2, 2026
A different company name can be a clue, but the assessment still has to establish which entity owns the service and control environment.
Validation
+4
Sep 1, 2026
3 min read
I built a validator to see how much of the evidence review can be assisted while keeping the assessment decision with the assessor.
Aug 19, 2026
A deployment label can tell you where software runs without telling you what the service can access, capture, store, or transmit.
Aug 12, 2026
Evidence quality matters. Evidence relevance matters more.
Revalidation
Aug 5, 2026
A prior assessment described a planned implementation. Revalidation showed the service had never actually been introduced.
