Unit 02 of 02
Application Compliance
Counting the engineering equivalent of an audit item: how many of twenty-six controls fall on a practice the team actually runs and how many fall on none, whether the answer to a control comes from a query, a document, or an individual's declaration, how far generating evidence in the pipeline reduces the items collected by hand and what cost automatic evidence creates in volume, retention, and personal data, how mean time to remediate and open finding age read in opposite directions from the same data, and how many items lack the timestamp the metric needs in order to be computed.
Published Updated
Lessons
- 01 Engineering Equivalent of Controls Twenty-six audit items are matched with the eighteen practices of an application team: after 25 links, 17 controls have an equivalent, 9 controls have no engineering equivalent at all, and five of those are gathered in a single compliance source. A control with an equivalent falls on 1.47 practices on average, 10 controls rest on a single practice, 2 practices fall on no control, and only 11 of the 26 questions are answered by querying the record. 15 min read
- 02 Evidence Automation Twenty-four audit evidence items are moved into the pipeline: the items touched by hand fall from 24 to 9, the annual compilation load falls from 213 hours to 96.2 hours, the 170-hour setup pays back in 1.46 years, and six items never become automatic under any condition. The cost appears in the opposite column: evidence records per period rise from 24 to 72,401, a factor of 3,017, the sampling rate falls from 100% to 0.63%, and the six items carrying a personal data type answer only 24.7% of the period because of a 90-day retention window. 15 min read
- 03 Application Security Metrics Of the 142 findings, the 121 that closed have a mean time to remediate of 17.0 days and a median of 6 days: the 30 items above the mean carry 75% of the total days. The same set gives opposite directions under two grouping rules — counted in the half it opened it falls from 23.6 to 7.6, counted in the half it closed it rises from 13.2 to 20.0 — and while the open queue falls from 24 items to 21, its mean age rises from 30.4 days to 59.8 days. Of eight questions, five are answered fully, one partially, and two are unanswered. Three interventions that improve the metric fix zero items: the mean goes to 12.6 days, the open finding age to 23.4 days, and the within-target rate to 94.2%. 14 min read
- 04 Security Debt Of a 34-item debt ledger, 21 are open and 13 are accepted risk; only 5 of the acceptances carry a validity period and only 2 carry a reassessment point. Of six questions, one is answered fully, four partially, and one is unanswered; making the partial answers full requires writing 26 fields. A four-period queue with 48 person-days of capacity closes 11 items of the 209 person-day ledger, and the mean age of the remaining queue rises from 91 days to 360 days. The 8 accepted items whose validity was never written are never asked about again in any period; of the 3 expired acceptances, only one carries a reassessment point. 13 min read