IS-11:VM-02-3P
Quarterly third-party external scanning for independent validation. Component of IS-11 §5.1 VM-02; ID assigned by ComplianceHub so the quarterly cadence is tracked separately from the monthly scan.
Not automatable. DeftTrust schedules this control, prepares the pack and files
the record it produces — it does not perform the judgement. The calendar still tracks it,
so it cannot silently lapse.
Collectors
| Collector | Relationship | Samples | What it observes |
|---|---|---|---|
| No collector references this control yet. | |||
Evidence satisfying this control
| Collected | Collector | Result | Source | Digest |
|---|---|---|---|---|
| No artifact satisfies this control. | ||||
Evidenced by a person. Security Officer / CTO owes this. The
scheduler opens a request 21 days
before it comes due; none is open right now.
Definition history
| Changed | Field | From | To | Source |
|---|---|---|---|---|
| 2026-09-10 03:32 | attestation_lead_days | 7 | 21 | sync_controls |
| 2026-09-10 03:32 | attestation_instructions | — | The third-party external scanning report for this quarter, … | sync_controls |
| 2026-09-10 03:32 | attestation_role | — | Security Officer / CTO | sync_controls |
A cadence change re-judges this control's existing evidence against the new interval, so its status can move the moment the change lands. That is why the change is recorded rather than just applied.