8.0 Tasks
Findings with an owner and a date
The work an assessment creates goes somewhere: one board, the same statuses for every kind of task, and a card that carries the context with it.
Quarterly access review: AWS production accounts
Pull every IAM user and role on the prod account and reconcile the entitlements against the joiner-mover-leaver record before the quarter closes.
Created 12 Apr
Collect the renewed SOC 2 report from Datadog
The report on file expires 30 Apr. Request the new one and the bridge letter ahead of the contract renewal review.
Created 12 Apr
Write up the backup restore test for A.8.13
February's restore drill ran without a written record, so the control has no evidence behind it. Capture the runbook, the result and the sign-off.
Created 13 Apr
Remediate A.5.1, three policies past their review date
Information security policies is failing at 43% readiness because the acceptable use, remote work and encryption policies are all overdue their annual review.
Created 8 Apr
Bring the last 12 admin accounts under SSO and MFA
Secure authentication (A.8.5) sits at 91% while these accounts authenticate outside the identity provider policy.
Created 9 Apr
Chase Acme Payments on the outstanding assessment
The questionnaire went out 14 days ago with no response. Escalate to the vendor owner before the contract review on the 25th.
Created 9 Apr
Review the evidence package for A.5.15 Access control
Eight files uploaded by the platform team; two failed the reviewed-within-required-period validation and need re-signing.
Created 5 Apr
Duplicate findings on the vulnerability scan import
March's scan imported twice, so A.8.8 counts 36 open findings where the scanner reported 18. De-duplicate and re-run the readiness calculation.
Created 7 Apr
Walkthrough pack for the ISO 27001 auditor engagement
Scope, control list and the evidence index assembled for the external auditor's opening meeting. With Adi for sign-off.
Created 3 Apr
8.1
One board, one vocabulary
Backlog, to do, in progress, in review, blocked, paused, done: the state of a remediation reads the same as the state of an evidence review.
8.2
Raised by the system
A scheduled access review opens its own task when it comes due, with the asset it covers and the date it is owed already on the card.
8.3
Assigned, not announced
Each task carries an assignee, a priority and a due date, so closing it is somebody's job rather than everybody's reminder.
Provable today, not at audit time.
Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.