Security, Privacy & Compliance

Coordinate risk-aware safeguards, qualified reviews and accountable decisions.

• Security review is scheduled one week before launch. What should I do?Late security assurance
• Our test environment contains real customer data. Is that acceptable?Uncontrolled test-data exposure
• A contractor still has access after leaving the project. What now?Incomplete access offboarding
• The team shares one administrator account. How do we change this?Weak individual accountability
• The vendor requests permanent full access for troubleshooting. Should we agree?Excessive support privileges
• Someone pasted a secret key into a project document. What do I do?Potential credential exposure
• A security exception is about to expire before delivery. Who decides?Unmanaged temporary risk acceptance
• We do not know how long to retain project files. What should we do?Undefined information retention
• Our team assumes the hosting country guarantees compliance. Is that enough?Oversimplified data residency assurance
• The security checklist is complete, but permission tests were never run. Is that enough?Unverified authorization controls
• Nobody owns the periodic access review. How do I establish it?Missing access recertification ownership
• A privacy assessment is requested after requirements are frozen. What now?Late privacy impact assessment
• The project discovered a possible data breach. Should I send details to everyone?Controlled incident communication
• The supplier says its certificate proves our configuration is secure. Is that true?Assurance scope mismatch
• We have backups, but no one has tested recovery. Can we launch?Unproven recoverability
• Users keep gaining extra roles as the project evolves. What is the risk?Permission accumulation
• Our consent screen does not match what analytics collects. What should happen?Mismatch between notice and data behavior
• A critical vulnerability appears during the final project week. What should I prioritize?Release-time vulnerability risk
• Audit asks for evidence, but the team only has verbal assurances. What can we provide?Insufficient control evidence
• Our project manager is asked to sign legal compliance. Should they?Authority and competence mismatch