Quarterly evidence scorecard
Q4 2021, 1 Oct 2021 to 31 Dec 2021.
Prepared 3 Jan 2022. Every number is counted from held records, and each links to the records behind it.
Decisions recorded in Q4 2021
A record counts once, under the verdict of its first version.
Decisions measured against a deadline
| Measure | Count |
|---|---|
| Decided before the CISA deadline | 1 of 2 |
| Decided after the CISA deadline | 1 of 2 |
| Decided before your own review-by date | 2 of 2 |
| Decided after your own review-by date | 0 of 2 |
| No deadline to measure against | 0 |
The CISA rows count the 2 records whose CVE has a CISA due date. The review-by rows count the 2 records with no CISA date and a review-by date. A record is counted in one of them, never both. A day counts in UTC.
Days from CISA listing to decision
The median is 10.5 days across 2 records.
Overdue reviews
2 records are past their review date with no newer version. 1 passed in Q4 2021.
| Record | Review date |
|---|---|
| Log4j2 configuration review | review-by 1 Dec 2021, passed this quarter |
| OpenSSL on the build host | review-by 15 Sep 2021, passed in an earlier quarter |
Alerts and coverage
| Measure | Count |
|---|---|
| Alerts raised for your stacks | 2 |
| CVEs alerted | 2 |
| With a decision recorded | 1 |
| With no decision recorded | 1 |
Coverage is 1 of 2 CVEs.
Without a decision: CVE-2021-45046.
Access history
| Measure | Count |
|---|---|
| Read by the owner | 3 |
| Read by a teammate | 1 |
| Read by someone with the link | 1 |
| Read by an auditor | 2 |
| Read by a named reader | 1 |
| All reads | 8 |
The number beside each reader is reads. The records behind it show how many reads each took.
Auditor grants
Chain integrity
Verified when this page was made: all 6 chains are intact, and every access history intact.
The records behind the numbers
Records made with the verdict patch by a date
- Log4j2 on the payments service recorded 11 Dec 2021
Records made with the verdict deferred
- Log4j2 configuration review recorded 5 Oct 2021
Records made with the verdict accepted
- Lodash in the admin console recorded 15 Nov 2021
Records made with the verdict mitigated
- Log4j2 on the search service recorded 30 Dec 2021
Decided before the CISA deadline
- Log4j2 on the payments service recorded 11 Dec 2021, CISA due 24 Dec 2021
Decided after the CISA deadline
- Log4j2 on the search service recorded 30 Dec 2021, CISA due 24 Dec 2021
Decided before your own review-by date
- Lodash in the admin console recorded 15 Nov 2021, review-by 15 Feb 2022
- Log4j2 configuration review recorded 5 Oct 2021, review-by 1 Dec 2021
Records measured from a KEV listing
- Log4j2 on the payments service listed 10 Dec 2021, decided 11 Dec 2021, 1 day
- Log4j2 on the search service listed 10 Dec 2021, decided 30 Dec 2021, 20 days
Records past their review date with no newer version
- Log4j2 configuration review review-by 1 Dec 2021, passed this quarter
- OpenSSL on the build host review-by 15 Sep 2021, passed in an earlier quarter
CVEs alerted for your stacks
- CVE-2021-44228 1 alert
- CVE-2021-45046 1 alert
Alerted CVEs with a decision recorded
- CVE-2021-44228 1 alert
Alerted CVEs with no decision recorded
- CVE-2021-45046 1 alert
Records read by the owner
- Log4j2 on the payments service 1 read
- Log4j2 on the search service 1 read
- Lodash in the admin console 1 read
Records read by a teammate
- Log4j2 on the payments service 1 read
Records read by someone with the link
- Log4j2 on the search service 1 read
Records read by an auditor
- Log4j2 on the payments service 1 read
- Lodash in the admin console 1 read
Records read by a named reader
- Log4j2 configuration review 1 read
Grants issued
- Priya Raman, Northgate Assurance LLP issued 18 Oct 2021, SOC 2 Type 2 fieldwork
Grants attested
- Priya Raman, Northgate Assurance LLP attested 20 Oct 2021
Grants revoked
- Priya Raman, Northgate Assurance LLP revoked 22 Dec 2021