Control calendar
Cadence comes from policy — it is what an auditor measures. How often a collector samples is a separate thing, shown on the Collectors page.
| Control | Status | Cadence | Last | Next due | TSC | Description |
|---|---|---|---|---|---|---|
| IS-02:AC-03 | No evidence | Monthly | — | — | CC6.1 | MFA enforced on all applicable systems |
| IS-02:AC-04 | No evidence | Quarterly | — | — | CC6.2 | Quarterly review of Access Matrix — verify users, roles, remove stale acc… |
| IS-02:AC-05 | No evidence | Quarterly | — | — | CC6.1 | Privileged access restricted to CTO, Head of People, CEO; reviewed quarte… |
| IS-02:AC-08 | No evidence | Monthly | — | — | CC6.1 | Password policy enforced: complexity, rotation, vault storage |
4 controls shown.