| 01Submitting and reviewing security evidence | Is the right evidence being submitted for each manual inspection item? Users must find and submit the right evidence for each of many manual inspection items, but the criteria are hard to interpret, and incorrect submissions lead to re-review and resubmission. | Can the time spent reviewing manual inspection evidence be reduced? Each piece of submitted evidence must be checked against security criteria item by item, which takes significant time and staff; when reviews pile up, other security work is delayed as well. |
| 02Deciding on security exceptions and deferrals | When can a security exception or deferral be requested? It is hard to tell whether a case qualifies for an exception or deferral, and writing a justification consistent with security policy takes considerable time and effort. | What criteria should be used to approve security exception and deferral requests? Approvers must review a wide range of request reasons and security risks, but repetitive similar cases and complex criteria increase workload and make consistent decisions difficult. |
| 03Processing security exceptions and deferrals | Should even simple exception and deferral requests wait this long for approval? Even standardized low-risk requests must pass through multiple review and approval steps, so approval takes time and follow-up work can be delayed. | Does every low-risk exception or deferral request need a full review? The same review and approval process applies even to repetitive low-risk requests, increasing workload and making it hard to focus on critical security risks. |
| 04Prioritizing vulnerabilities | With so many vulnerabilities, where do you start? Many vulnerabilities must be remediated in limited time, and misjudged priorities can delay or miss critical fixes. | Are critical security risks slipping through your prioritization? It is difficult to weigh vulnerability severity, asset criticality and external threat intelligence together, so high-risk vulnerabilities can be missed or priorities set incorrectly. |
| 05Security management blind spots | Do you have an accurate picture of the assets and inspection targets you are responsible for? If asset and owner information is inconsistent or out of date, inspection targets or vulnerabilities that need action can be missed. | Are asset data inconsistencies causing you to miss critical security risks? Inconsistent or missing information across assets, information systems and owners can lead to misidentified inspection targets and blind spots in risk management. |
| 06Handling security inquiries | How long must you wait for answers to security questions? To check inspection criteria, remediation methods or exception and deferral procedures, users must ask the person in charge, and delayed answers can hold up their work. | Do repetitive security inquiries have to be answered one by one? With limited security staff handling a wide range of inquiries, repetitive guidance consumes time and makes it hard to focus on critical security management. |