Internal Security Reviews
Security reviews is a register of recurring security activities, for example an annual penetration test or a quarterly architecture review. It helps you show that you test and review your products on a regular schedule. Security reviews need the Reporting plan or higher.
Add a review
- Go to Settings → Security Reviews.
- Enter the name.
- Select the category: test, review, assessment or audit.
- Select the frequency: weekly, monthly, quarterly, biannually or annually.
- Optional: enter the methodology, the scope, the responsible person and a start date.
- Optional: set how many days before the due date CVD Portal sends a reminder. The default is 14 days.
CVD Portal calculates the next due date from the start date and the frequency.
Complete a review
When you finish a review, mark it as complete and add notes, for example your findings. CVD Portal records the completion date and the notes, calculates the next due date, and writes an audit log entry.
Reminders
Every day, a scheduled job finds reviews that are in their reminder window. CVD Portal sends a reminder email to the company admins and sends the sla.deadline_approaching event to your webhooks.
Limits
Security reviews is a schedule and evidence register. It does not add approval steps to report status changes or to advisory publication.