Assessment & Evidence Cadence
| Owner | Classification | Version | Effective | Next review | Status |
|---|---|---|---|---|---|
| Sekhar Prakash | Internal | 0.1 | 2026-08-27 | 2026-11-27 | Draft |
Purpose. The operating schedule for the security programme — what assessments and control activities run, how often, who owns them, and where their output lands.
It turns the control set from a static list into an operating system: this is what makes a SOC 2 Type II observation window produce evidence continuously rather than in a pre-audit scramble. ⚠️ Since 2026-09-15 the continuous half rests on scheduled activities rather than per-PR gates — see the Control Register.
How to read
Two tiers, each activity naming its owner and its evidence destination:
- Automated — runs without human initiation. ⚠️ No activity in this tier currently gates a merge; the guards that did were withdrawn on 2026-09-15 (see Control Register).
- Periodic — scheduled; driven by calendar reminders until a GRC tool automates collection.
Automated (machine-run — none currently blocking)
| Activity | Lens | Evidence → | Status |
|---|---|---|---|
Dependency scan (bun audit) | SCA | Dependency Health mail | ✅ live — weekly, non-blocking (listed under Periodic) |
| Secret scanning (gitleaks) | Secret | Findings · Evidence | 🎯 in-CI |
| Static analysis (CodeQL / Semgrep) | SAST | Findings · Evidence | 🎯 not yet run |
| IaC scan (tfsec / checkov) | IaC | Findings · Evidence | 🎯 in-CI |
| Container image scan (Trivy) | Image | Findings · Evidence | 🎯 in-CI |
| Lockfile guard | Integrity | — | ⛔ withdrawn 2026-09-15 — see Control Register |
| Cloud posture (Prowler / Security Hub) | CSPM | Findings · Evidence | 🎯 at AWS go-live |
Periodic (scheduled)
| Activity | Frequency | Owner | Evidence → |
|---|---|---|---|
Dependency scan (bun audit) | Weekly (Sun) | Sekhar | Dependency Health mail · Control Register |
| Posture re-verification | Quarterly + ad hoc | Sekhar | Posture · Audit Log |
| Risk register review | Quarterly | Sekhar | Risk Register |
| Threat-model review | Quarterly + per significant change | Sekhar / Eng | Evidence · Risk Register |
| Access review (prod + source control) | Quarterly | Sekhar | Evidence (export) |
| DAST scan | Quarterly | Sekhar | Audit Log · Findings |
| Backup / restore drill | Quarterly | Sekhar | Evidence · Staging DB Restore Console |
| Vendor / subprocessor review | Annual + on onboarding | Payeli | Subprocessors |
| Penetration test | Annual + major change | Sekhar (3rd party) | Audit Log |
| IR tabletop exercise | Annual | Sekhar | Evidence |
| Security-awareness training | Onboarding + annual | Payeli | Evidence (completion records) |
| Policy review | Annual | Policy owners | Policy revision history |
| Management review | Quarterly / annual | CEO / COO | Evidence (minutes) |
| DPIA (on new/changed data flows) | Per change | Payeli | DPIA |
Where output is kept & shown
- Findings (open gaps) → GitHub issues, indexed in the Findings Register.
- Evidence (proof + freshness) → Evidence Register — links to CI artifacts, config exports, review exports, reports.
- Run history → Audit & Assessment Log.
- Current state → Security Posture; lens coverage → Coverage.
Related
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | 2026-08-27 | Sekhar Prakash | Initial cadence — automated and periodic activities with owners and evidence destinations. |
Finaisse Internal — Confidential. Not for external distribution.