What changes
Organisations covered by the law have a duty of care. The RDI lists, among other things: secure your supply chain, with clear agreements with suppliers about cyber security, secure your network and information systems, and know how you handle vulnerabilities. They report a serious incident within 24 hours.
So their suppliers get questionnaires. If you build software for such customers, or your own business runs on a customer portal or planning tool, you need to show how that software is developed and kept up to date.
The questions you'll get about your software
About software you develop yourself, the questions are often these:
- How do you know it contains no dependencies with known vulnerabilities?
- Are changes tested before they go live, and can you show it?
- How do you keep passwords and keys out of the code?
- Which parts no longer get security updates?
- Is it written down how you recover after an outage or an incident?
How our checks help
Our checks look at exactly these questions: vulnerable and outdated dependencies, secrets in the code and its history, evidence from your CI that it was tested, and whether the documentation for security and recovery exists. Every finding with its evidence.
You can use your view as support for your customers' questionnaires. With continuous checks that answer keeps holding with every new version.