-
Acceptable Use Policy and Remote Working and Mobile Devices Policy should be one document: Both Policies set the rules for company and personal devices and for the accounts on them, and they cover the same Requirement on user endpoint devices, so a reader has to check two documents for one answer.
Recommended survivor: POL-002 — Acceptable Use Policy
Keep Acceptable Use Policy. Combine the documents, move the links, and archive the other through the Assistant write tools.
-
Internal Audit and Management Review Procedure should be two documents: Part A plans and runs the internal audits and Part B prepares and holds the management review. They have different owners, different timing, and different records, so each reads better as a Procedure of its own.
- Internal Audit Procedure — Planning, independence, and carrying out the internal audits, and the records of each audit.
- Management Review Procedure — Preparing and holding the management review, and the decisions that come out of it.
Create "Internal Audit Procedure" and "Management Review Procedure". Create the second document, move the right links, and edit both bodies through the Assistant write tools.
-
Physical and Environmental Security Policy words do not speak to one or more linked Requirements.
- iso-27001-2022 A.7.12 — The Policy covers security zones, office and data centre access, and environmental threats, but it does not speak of cabling, which is what this Requirement is about.
iso-27001-2022 A.7.12: The Policy covers security zones, office and data centre access, and environmental threats, but it does not speak of cabling, which is what this Requirement is about.
Edit the Policy words and/or change the Requirement coverage links so the document speaks to each listed Requirement.
-
Procedure implementation adequacy
Physical Access and Visitor Management Procedure words do not speak to one or more Policies it implements.
- POL-014 — Remote Working and Mobile Devices Policy — The Procedure covers visitors, badges, the Restricted zone, and data centre visits, but it does not speak of remote working, which is what this Policy is about.
Remote Working and Mobile Devices Policy: The Procedure covers visitors, badges, the Restricted zone, and data centre visits, but it does not speak of remote working, which is what this Policy is about.
Edit the Procedure words and/or change which Policies it implements so the document speaks to each listed Policy.
-
Not on file: Data Processing Agreement, sub-processor list, terms of service, service level agreement, security certification.
File each found document on the Supplier as an Attachment, using its web address:
sub-processor list: https://www.atlassian.com/trust/compliance/resources/sub-processors
terms of service: https://www.atlassian.com/legal/cloud-terms-of-service
service level agreement: https://www.atlassian.com/legal/sla
Set the Supplier's Website to https://www.atlassian.com.
No Data Processing Agreement was found. Ask the Supplier for one, and offer to create a Task to track the request.
-
2 known vulnerabilities in software from Fortinet are not in the Vulnerability register.
Known vulnerabilities
-
CVE-2026-24858
Authentication bypass in the FortiOS administrative interface
Critical
CVSS score 9.8
Known exploited
-
CVE-2026-22153
Heap overflow in the FortiOS SSL VPN daemon
High
CVSS score 7.2
Record each vulnerability as a Vulnerability, linked to its affected Assets.
CVE-2026-24858: Authentication bypass in the FortiOS administrative interface (severity: Critical; severity value: critical; CVSS score: 9.8; known exploited: Yes; advisory: https://www.fortiguard.com/psirt/FG-IR-26-060; affected Assets: AST-037 (fab29514-4f04-bd44-b1c6-9520f2de1374))
CVE-2026-22153: Heap overflow in the FortiOS SSL VPN daemon (severity: High; severity value: high; CVSS score: 7.2; known exploited: No; advisory: https://www.fortiguard.com/psirt/FG-IR-25-912; affected Assets: AST-037 (fab29514-4f04-bd44-b1c6-9520f2de1374))
Call create_vulnerability once per line above: external_identifier is the identifier, title is the title, severity is the severity value, cvss_score is the CVSS score, source is vendor_advisory, discovered_at is today's date, external_link is the advisory address, and affected_asset_ids are the ids of the affected Assets. Leave source_reference empty. Wait for the member's confirmation before you write.
-
A sub-processor changes without notice to customers has no Requirement coverage.
Link eu-gdpr-2016 Art. 28: The processor agreements are where customers agreed to the list of sub-processors and to notice of a change, so a sub-processor that changes without notice breaches exactly what this article asks the agreements to hold.
Link iso-27001-2022 A.5.22: This is the control for following changes in a supplier's service between reviews, which is the gap that lets a sub-processor move processing without Tidewell IT noticing.
-
Unmanaged devices on the office network has no Requirement coverage.
Link iso-27001-2022 A.8.1: Personal devices that visitors, contractors, and staff plug into the network of the Utrecht office are user endpoint devices, and the device management Tidewell IT already runs for its own laptops and mobile devices is the control that would cover them.