Observations about what is actually in scope today versus what prior records, contracts, or assumptions suggest.
Vendor Activity
+3
Nov 4, 2026
•
2 min read
Not every unanswered assessment question belongs to the vendor. Sometimes the customer is the authoritative source for whether a third-party relationship actually exists.
Questionnaire
Oct 28, 2026
A vendor may have AI across its product portfolio, but the assessment should start with the specific AI functionality actually being used in the relationship.
Oct 14, 2026
An active contract doesn’t tell you how much of the original vendor relationship is still operating. The current activity and data flow do.
Oct 7, 2026
A question may not fit the vendor’s environment, but that does not always mean the underlying control responsibility disappears.
Assessment History
Sep 23, 2026
An acquisition may change who owns the company without changing what the previous assessment actually covered.
Data Flow
+2
Sep 9, 2026
No system connection doesn’t mean no data flow. Sometimes the path to the vendor runs through the people using the service.
Assessment Judgement
Sep 2, 2026
A different company name can be a clue, but the assessment still has to establish which entity owns the service and control environment.
Validation
+4
Sep 1, 2026
3 min read
I built a validator to see how much of the evidence review can be assisted while keeping the assessment decision with the assessor.
Aug 19, 2026
A deployment label can tell you where software runs without telling you what the service can access, capture, store, or transmit.
Aug 12, 2026
Evidence quality matters. Evidence relevance matters more.
Revalidation
Aug 5, 2026
A prior assessment described a planned implementation. Revalidation showed the service had never actually been introduced.
