Finding closure
A Finding Is Not Ready to Close Because the Sentence Changed
A stronger status narrative cannot compensate for a control that is still undefined, unowned, or unevidenced.
Field Notes
Clear thinking for consequential security decisions.
Short, practical observations for leaders who must connect requirements, system design, operating evidence, and executive accountability.
Featured download · PDF
Is This Finding Actually Ready to Close?
A 10-gate readiness checklist for testing the finding definition, remediation design, evidence package, and sustainable ownership before the next review.
Get the ChecklistFrom the field
Questions worth answering before the next review.
These field notes reflect the recurring issues Nerthus helps leaders make specific, executable, and defensible.
Corrective action
Why CAPs and POA&Ms Keep Reopening
Recurring corrective actions usually reveal a broken chain between cause, design, implementation, and proof.
Buyer diligence
Your Regulated Buyer Is Evaluating the System, Not the Policy Library
Buyers test whether the written answer matches architecture, contracts, operations, and evidence.
Compensating controls
What Makes a Compensating Control Defensible?
A compensating control must address the original risk, fit the environment, and produce sustainable evidence.
Identity
Identity Proofing Is Not Authentication
Conflating identity proofing, credentials, authentication, and authorization creates dangerous gaps.
Contract boundaries
Security Risk Hides in Contract Boundaries
The hardest control failures often live in the space between what a system needs and what a contract actually assigns.
AI governance
AI Governance Must Begin Before the Feature Launches
The decision trail, data constraints, human oversight, and monitoring plan must exist before production pressure takes over.
Regulated systems
The Acronyms Differ; the Assurance Questions Repeat
Across regulated environments, the core questions remain: required, implemented, owned, evidenced, and sustained.
Put the guidance to work
Have a finding or control that needs more than a checklist?
Bring the requirement, current state, and deadline. Nerthus will help define the work needed to reach a defensible position.