Owner: CISO · Reviewed: Quarterly · Frameworks: SOC 2 Type II, ISO 27001
What this is
This page is the single calendar view of every recurring, triggered, or SLA-driven activity referenced in Neuroscale’s policies and procedures. It is built for:- The CISO, to see every commitment in one place and assign owners + due dates.
- Auditors, to map a control to the cadence and the evidence location.
- Program leads (Engineering, CHRO, Legal, IT), to see what their team owes the program over the next quarter.
Upcoming highlights
Annual
| Activity | Cadence / Trigger | Owner | Source | Evidence |
|---|---|---|---|---|
| Policy review (every policy) | Annual | Policy owner (the CISO for security policies) | How to use these docs → Reviewing & updating policies | Version-history row updated; PR in this repo |
| Policy re-acknowledgement (all employees + contractors) | Annual | CHRO + Vanta | HR Security → Information security awareness, education & training; Acceptable Use → Acknowledgement | Vanta acknowledgement records |
| Security-awareness training | Annual (and at hire) | CHRO via Vanta | HR Security → Information security awareness, education & training | Vanta training-completion report |
| Secure-development / OWASP training (engineers) | Annual | the CISO + Engineering | Secure Development → Developer training; Secure Coding → Common-vulnerability training | Training vendor completion records (Vanta) |
| BC/DR test including backup-restore test | Annual | the CISO | Business Continuity → Policy; Operations Security → Information backup | BC/DR test report; restore-test ticket in Linear |
| Incident-response tabletop / IR plan test | Annual | the CISO | Incident Response → Additional requirements | Tabletop minutes and findings; SharePoint evidence library |
| Penetration test (applications + production network) | Annual (and after major changes) | the CISO + Engineering | Operations Security → Technical vulnerability management; Vulnerability Management → Sources of findings | Pen-test report; remediation tickets |
| Network-security assessment (incl. major-change review) | Annual | the CISO + Engineering | Operations Security → Systems security assessment & requirements | Assessment report |
| Production network-config / firewall rule review | Annual | Engineering | Operations Security → Configuration & hardening; Configuration & Hardening → Network standards | Network-config review ticket; IaC PR diff |
| Risk assessment (formal) | Annual | the CISO | Risk Management → Practical application; Risk Management → 4. Maintain | Vanta risk register snapshot; risk-assessment report |
| Risk reporting to executive leadership | At least annual | the CISO | Roles & Responsibilities → CISO | Board / executive deck; meeting minutes |
| Cloud-service-agreement review (high-risk providers) | Annual | the CISO + CFO | Third-Party Management → Service selection & usage scope | Vendor file in Vanta; signed agreement on file |
| Vendor re-review (Tier-High) | Annual | the CISO + CFO | Vendor Risk Assessment → Process | Re-review record in Vanta vendor inventory |
| Vendor re-review (Tier-Medium) | Every 2 years (biennial) | the CISO + CFO | Vendor Risk Assessment → Process | Re-review record in Vanta vendor inventory |
| Supplier service-delivery / performance review | Annual | the CISO + CFO | Third-Party Management → Monitoring & review | Supplier review record |
| Annual performance review (incl. policy & Code-of-Conduct adherence) | Annual | CHRO + managers | HR Security → Competence & performance assessment | HRIS performance record |
| Data-retention requirements review | Annual | the CISO + data owners | Data Management → Annual review; Data Retention Matrix | Updated retention matrix; PR in this repo |
| Internal retention & disposal procedure review | Annual | Engineering | Data Retention Matrix → Internal retention & disposal | Procedure-review ticket |
| Legal-hold review with counsel | Annual | General Counsel | Data Management → Legal holds | Legal-hold tracker |
| Long-lived API key rotation | Annual (or on personnel change) | Engineering | Secrets Management → Rotation | Vault audit-device rotation log |
| AWS shared-responsibility / controls inventory review | Annual | the CISO + Engineering | Configuration & Hardening → Cloud provider | Vanta controls inventory |
Quarterly
| Activity | Cadence / Trigger | Owner | Source | Evidence |
|---|---|---|---|---|
| User-account access review | Quarterly | the CISO | Access Control → Access reviews; Access Reviews → Cadence | Signed-off review document in SharePoint evidence library |
| Privileged / admin-account access review | Quarterly | the CISO | Access Reviews → Cadence | Signed-off review document in SharePoint evidence library |
| Service-account access review | Quarterly | the CISO | Access Reviews → Cadence | Signed-off review document in SharePoint evidence library |
| Kubernetes RBAC review | Quarterly | Engineering | Configuration & Hardening → Orchestration security | RBAC review ticket |
| Vulnerability scan — public-facing production systems | Quarterly (at least) | the CISO + Engineering | Operations Security → Technical vulnerability management; Vulnerability Management → Sources of findings | Detectify scan report; tickets for findings |
| Risk-register review | Quarterly | the CISO | Compliance Frameworks → How controls are tested; Risk Management → Risk response, treatment, and tracking | Vanta risk register |
| Vulnerability remediation status report to leadership | Quarterly | the CISO | Vulnerability Management → Tracking | Leadership deck / Linear vulnerabilities board |
Monthly
No strictly monthly cadences are defined in the current policy set. The closest cadences below monthly are continuous (daily/weekly) and the closest above are quarterly. If a monthly review is added (e.g., monthly endpoint-compliance dashboard review), record it here.
| Activity | Cadence / Trigger | Owner | Source | Evidence |
|---|---|---|---|---|
| None defined | — | — | — | — |
Continuous
| Activity | Cadence / Trigger | Owner | Source | Evidence |
|---|---|---|---|---|
| Backups of in-scope systems | Daily | Engineering | Operations Security → Information backup | AWS Backup job history |
| Cross-region backup replication | Continuous | Engineering | Operations Security → Information backup | AWS replication metrics |
| Production logging — auth, CRUD, security-settings, admin access | Continuous | Engineering | Operations Security → Logging & monitoring; Logging & Monitoring → What we log | Better Stack / CloudWatch / S3 Object Lock bucket |
| Log retention — Security & audit logs | 90 days hot / 13 months total | Engineering + CISO | Operations Security → Log retention tiers | Better Stack + S3 (Object Lock) |
| Log retention — Application logs | 30 days hot / 90 days total | Engineering | Operations Security → Log retention tiers | Better Stack retention config |
| Log retention — Database / data-access logs | 90 days hot / 13 months total | Engineering | Operations Security → Log retention tiers | RDS / CloudWatch / S3 |
| Log retention — Infra & change logs | 90 days hot / 2 years total | Engineering | Operations Security → Log retention tiers | GitHub / CloudTrail / S3 |
| Anti-malware / EDR (Rippling) on endpoints | Continuous; auto-updates | IT (the CISO) | Operations Security → Protection from malware | Rippling console |
| Email threat detection (Material) | Continuous | the CISO | Operations Security → Protection from malware | Material console |
| Web filtering / secure DNS | Continuous | the CISO | Operations Security → Web filtering | Rippling config |
| File integrity monitoring / IDS | Continuous | Engineering | Operations Security → File integrity monitoring & intrusion detection | FIM/IDS alerts |
| Threat-intelligence collection & analysis | Continuous | the CISO | Operations Security → Threat intelligence | Internal intel notes; Slack #security |
| Vanta continuous-control monitoring | Daily | the CISO | Compliance Frameworks → How controls are tested | Vanta dashboard |
| Mobile-device lock after inactivity | After 5 minutes | All employees / contractors | Information Security → Mobile device policy; Data Management → Confidential data | Rippling compliance report |
| Full-disk encryption on all laptops / mobiles | Continuous | IT (the CISO) | Cryptography → Operational requirements | Rippling / FileVault / BitLocker reports |
| Clear-screen / clear-desk | Continuous | All employees | Information Security → Clear screen, clear desk | Manager observation; periodic walk-through |
| Static / dependency / secret scanning on every PR | Continuous (per PR) | Engineering | Secure Development → Application vulnerability management; Secure Coding → Tooling | GitHub checks; Semgrep / Snyk / gitleaks reports |
| Container scanning | Continuous (per build) | Engineering | Secure Coding → Tooling | Trivy / Snyk Container reports |
| Code review on every PR (≥1 approval, non-author) | Continuous (per PR) | Engineering | Code Review → Requirements | GitHub PR record |
| Vulnerability triage status review | Weekly | the CISO + Engineering | Vulnerability Management → Tracking | Linear “Vulnerabilities” board |
| Clock synchronization (NTP) | Continuous | Engineering | Operations Security → Clock synchronization; Logging & Monitoring → Clock synchronization | AWS Time Sync configuration |
| Privileged-action logging | Continuous | Engineering | Access Control → Privileged access | S3 Object Lock audit-log bucket |
Triggered
| Activity | Cadence / Trigger | Owner | Source | Evidence |
|---|---|---|---|---|
| Background check (Checkr) | At hire | CHRO | HR Security → Screening; Onboarding → Before day 1 | Checkr report on file |
| Signed offer / IP / NDA / Code-of-Conduct acknowledgement | At hire | CHRO | HR Security → Terms & conditions of employment; Onboarding → Before day 1 | Signed agreements in HRIS |
| Security-awareness training (initial) | At hire | CHRO via Vanta | HR Security → Information security awareness, education & training; Onboarding → Within first week | Vanta training record |
Policy acknowledgement (all 24 policies (22 in /policies/ + 2 in /legal/)) | At hire | New hire via Vanta | Onboarding → Within first week | Vanta acknowledgement record |
| Identity + standard access bundle provisioned | At hire (after HR onboarding completes) | IT (the CISO) | Access Control → Provisioning; Access Management → Provisioning | Linear “Access” tickets |
| MFA enrollment | At hire | New hire + IT | Onboarding → Day 1 | IdP MFA-enrolment status |
| Role-specific access onboarding (e.g., production access training) | Within 30 days of hire | Manager + IT | Onboarding → Within first 30 days | Linear onboarding ticket |
| Access review on role change | Triggered (promotion / demotion / transfer) | the CISO | Access Control → Access reviews; Access Reviews → Cadence | Access-change ticket; signed-off review |
| Access modification on role change | Triggered (promotion / demotion / transfer) | Manager + system owner + IT | Access Management → Change requests | Linear access-change ticket |
| Privileged-access elevation approval | Triggered (per request) | the CISO or system owner | Access Management → Change requests | Approval recorded in ticket |
| Offboarding workflow (disable IdP, revoke sessions, remove groups, revoke prod access, rotate shared secrets, suspend email, collect device, file evidence) | At termination | CHRO + IT + Security | Offboarding → Checklist (IT / Security); HR Security → Termination process | Offboarding ticket + signed return form |
| Asset return at termination | At termination | Departing user + IT | Asset Management → Return of assets; Offboarding → Devices | Return form; Rippling disposition record |
| Lost / stolen device report | On loss | Reporter → IT / Security | Asset Management → Loss or theft of assets; Information Security → Mobile device policy | Helpdesk ticket; security-incident ticket if applicable |
| Security-event / incident report | Immediately on discovery | Reporter → security@neuroscale.ai | Information Security → Security incident reporting; Incident Response → Reporting | Linear “Security Incidents” project |
| Incident response activation (P0/P1) | On verified incident | Incident Manager (the CISO or CTO) | Incident Response → Escalation; Incident Response → Incident response process | Incident ticket; war-room channel; RCA |
| Root-cause analysis | After every verified P0 incident | Incident Manager | Incident Response → Documentation | RCA in Linear incident ticket |
| Emergency change retrospective review | Within 24 hours of emergency change | Engineering on-call + the CISO if security-related | Operations Security → Change management; Change Management → Emergency change | Retrospective PR or ticket |
| Vendor risk assessment | Before sharing Confidential data / granting prod access / signing contract | the CISO + CFO | Vendor Risk Assessment → When to run an assessment; Third-Party Management → Third-party risk management | Tiering + due-diligence packet in Vanta |
| Secret rotation on compromise | Immediate (treat as P0 / P1) | Engineering + Security | Secrets Management → On compromise | Incident ticket; Vault audit-device rotation log |
| Customer-data deletion | Triggered by contract termination | CTO / Engineering | Data Management → Data & device disposal; Data Retention Matrix → Customer accounts | Deletion job log; ticket reference |
| Disposal of devices / media holding Confidential data | Triggered by EOL / damage | IT (the CISO) | Asset Management → Asset disposal & re-use; Data Retention Matrix → Devices | Wipe record or Certificate of Destruction (COD) |
| BC/DR plan activation | On office unavailability or major regional event | the CISO + executive staff | Business Continuity → Plan activation | Activation log; comms timeline |
SLA-driven
| Activity | SLA | Owner | Source | Evidence |
|---|---|---|---|---|
| Access termination (offboarding) | Within 24 business hours of separation; immediate for involuntary / high-privilege | CHRO + IT | Access Control → Removal & adjustment; Offboarding → SLAs; Access Management → Deprovisioning | Offboarding ticket timestamps |
| Access-review remediation execution | Within 5 business days of sign-off | IT (the CISO) | Access Reviews → Process | Access-change ticket close-out time |
| Records of permission / privilege changes | Retained at least 1 year | IT (the CISO) | Access Control → Provisioning; Access Reviews → Records | Access-change ticket history |
| Offboarding evidence retention | At least 1 year | CHRO + IT | Offboarding → Records | SharePoint evidence library |
| COD (Certificate of Destruction) retention | 1 year | IT | Data Retention Matrix → Devices; Offboarding → Devices | COD on file |
| Vulnerability remediation — Critical | 7 days | Engineering | Operations Security → Technical vulnerability management; Vulnerability Management → Remediation SLAs | Linear vulnerability ticket |
| Vulnerability remediation — High | 30 days | Engineering | Vulnerability Management → Remediation SLAs | Linear vulnerability ticket |
| Vulnerability remediation — Medium | 60 days | Engineering | Vulnerability Management → Remediation SLAs | Linear vulnerability ticket |
| Vulnerability remediation — Low | 90 days | Engineering | Vulnerability Management → Remediation SLAs | Linear vulnerability ticket |
| Application vulnerability patching | Within 90 days of discovery | Engineering | Secure Development → Application vulnerability management | Patch ticket / deploy record |
| P0 alert acknowledge | 5 minutes | Engineering on-call | Logging & Monitoring → Alerting | Better Stack timeline |
| P0 begin remediation | 15 minutes | Engineering on-call | Logging & Monitoring → Alerting | Better Stack timeline |
| P1 alert acknowledge / begin remediation | 15 min / 1 hr | Engineering on-call | Logging & Monitoring → Alerting | Better Stack timeline |
| Mobile device lock after inactivity | After 5 minutes | All employees / contractors | Information Security → Mobile device policy; Data Management → Confidential data | Rippling compliance report |
| Password length / lockout | ≥12 chars (8 only as a fallback floor where a system cannot be configured higher); lock after 6 failed attempts | IT | Access Control → Password policy | IdP / SSO config |
| Web certificate max expiration | Up to 1 year | Engineering | Cryptography → Recommended cryptographic key usage | ACM cert inventory |
| Symmetric data-at-rest key max expiration | 1 year | Engineering | Cryptography → Recommended cryptographic key usage | KMS rotation config |
| Customer-data deletion after contract termination | Within 60 days of termination | CTO / Engineering | Records Retention Schedule → Customer data; Data Retention Matrix → Customer accounts | Deletion job log |
| Log retention (hot — security/audit) | 90 days | Engineering | Operations Security → Log retention tiers; Logging & Monitoring → Retention | Better Stack retention config; S3 Object Lock |
| Log retention (hot — application) | 30 days | Engineering | Operations Security → Log retention tiers | Better Stack retention config |
| Security-policy archive retention | 1 year after archive | the CISO | Data Retention Matrix | SharePoint policy archive |
| Breach notification — external | Without undue delay per contracts and law | CEO + General Counsel | Incident Response → External communications and breach reporting | Breach-notice records (Legal) |
| Whistleblower investigation records retention | 7 years from disposition (longer with legal hold) | General Counsel | Whistleblower → Records | Legal investigations file |
Audit-evidence map
For SOC 2 / ISO 27001 evidence collection, this is where each control’s artifact should live. When in doubt, drop it in Vanta and the SharePoint evidence library — auditors check both.| Evidence type | Primary location | Secondary / supporting |
|---|---|---|
| Policy acknowledgement records | Vanta | — |
| Security-awareness + secure-dev training records | Vanta | — |
| Access-review sign-offs | SharePoint evidence library | Linear access-change tickets |
| Access-change tickets / approvals | Linear (“Access” team queue) | SharePoint |
| Onboarding completion | Linear (CHRO onboarding workflow) | Vanta (training, ack) |
| Offboarding completion (deprovisioning + device return + COD) | Linear (CHRO offboarding workflow) | SharePoint evidence library |
| Background-check reports | Checkr | HRIS |
| Asset inventory | Vanta + Rippling | — |
| Risk register & risk-assessment report | Vanta risk register | SharePoint |
| Vendor due-diligence packets + re-reviews | Vanta vendor inventory | SharePoint |
| Incident tickets, RCAs, post-mortems | Linear (“Security Incidents” project) | Slack #security-incidents |
| Pen-test, vulnerability-scan, network-assessment reports | SharePoint evidence library | Linear “Vulnerabilities” board for findings |
| Vulnerability tickets + remediation status | Linear “Vulnerabilities” board | GitHub PRs |
| Change-management records (PRs, deploys, retros) | GitHub | Linear |
| Code-review approvals | GitHub | — |
| CI security-scan results (SAST, SCA, secrets, container) | GitHub Advanced Security + Snyk + gitleaks + Trivy | — |
| Production logs (auth, CRUD, security settings, admin access) | Better Stack (app), CloudWatch (infra), S3 Object Lock (audit) | — |
| On-call response times | Better Stack | — |
| Backup job history + restore-test results | AWS Backup | Linear restore-test ticket |
| BC/DR test minutes / IR tabletop minutes | SharePoint evidence library | — |
| Endpoint compliance (FDE, MDM, lock timeout, EDR) | Rippling | Vanta |
| Email threat-detection events | Material console | — |
| Secrets storage + rotation logs | HashiCorp Vault (audit device → Better Stack + AWS S3 Object Lock) | Dashlane (dev) |
| Whistleblower / ethics reports + investigations | Legal investigations file | Anonymous service vendor (todo) |
| Legal-hold tracker | SharePoint Legal folder — Legal-Hold register (GC owner) | — |
| Breach-notification records | Legal investigations file | — |
How this calendar is maintained
- Quarterly review by the CISO. Stale rows are corrected; new rows are added for any policy changes since the last review.
- PR coupling. Any change to a policy or procedure that adds, removes, or retimes a recurring activity must update this page in the same PR. The reviewer rejects the PR if this page is out of sync.
- First-due dates are filled in when the v1.0 policy set takes effect — see Finalization Tasks → Effective dates.
- Source of truth for cadence is always the linked policy / procedure. If this page disagrees with a policy, the policy wins and this page is corrected.
Anchors on this page are derived from heading text in the linked file (Mintlify lowercases and replaces spaces / non-alphanum with hyphens). Mintlify’s broken-link checker does not validate fragments — verify anchors manually when changing a referenced heading.
Version history
| Version | Date | Description | Author | Approved by |
|---|---|---|---|---|
| 1.0 | May 8, 2026 | Initial version | Cameron Wolfe | Ishan Jadhwani |