Tech, policy and power. For the people who have to sign off on it.
Several instruments now want a version of the same list, each with its own fields and no shared spine. Two or three days of one person's time for a first pass at a couple of hundred staff, six weeks if the first decision anybody makes is to buy a tool.
We rank three products against third-party risk requirements and put first the one our own publisher operates. The criteria come before the verdict so you can reweight them, and the vendor with the best design here has the thinnest assurance file of the three.
Common Criteria paperwork is turning up in device tenders as though it closed the question. It closes a narrow one, about software that stopped existing on the day the lab finished, in a configuration the vendor scoped itself.
A bank that licenses a credit-scoring model is a deployer under Article 26, and a deployer owes oversight, retained logs and a notice to the people it turns down. Article 27 assumes an assessment document that nobody has produced a template for.
A composite savings bank, two part-time privacy staff and two hundred and forty thousand hours of call recordings. This page sets the criteria and the weights; the ranked verdict follows the testing.
Ten seconds, any hour, irrevocable. The name-check that is supposed to hold the line has a third answer — close match — and the text does not say what happens after it.
Moving a processing activity from one lawful basis to the other changes nothing the user can see. It changes who has to move first, and almost nobody moves.
The connector was settled in a directive years ago and arrived on schedule. Nobody settled which of the four identical black cables in the drawer will charge the machine at full speed.
Article 28 lets a customer object when a platform adds a new supplier. It does not say how much notice, what an objection does, or whether anybody has to answer one.
The credit is measured per service, per region, claimed by you, and named the only thing you get. The postmortem that follows commits the provider to nothing with a date on it.
A regional water utility, nine hundred staff, eleven control sites and three people in security. The criteria and the weights are here; the ranking waits for testing that starts in January.
This week’s seven is shu. Default, and the fallback. The wordmark never changes; the seven changes every Monday, and out of cycle when the news demands it.