Stonetusker Insights · Five-minute checklist
Regulated Data and Audit-First: 5-Minute Delivery Risk Checklist and Dates to Watch
Eight yes or no questions for teams whose releases must stand up to an audit. Each one links to the page that explains it, and the dates below show which gaps carry a deadline.
For: Leaders of engineering teams in healthcare, medical technology, financial services, public sector or education, where every release has to stand up to an audit.
Technical and engineering guidance. Please confirm legal obligations with your own counsel.
The short version
- Eight yes or no questions about delivery risk for regulated, audit-first organisations.
- Ask your team to answer them in five minutes, from what they know today, with no checks run first.
- A "no" marks a gap worth a closer look. The dates below show which gaps carry a deadline.
Eight questions for your team
- Does every production release come with a software bill of materials (a list of every component) that the build itself produced? Why it matters
- Does that record include a hash and a licence for most components? Why it matters
- Is the record signed, so a customer can confirm that nobody changed it? Why it matters
- Does every public security certificate renew automatically, with no calendar reminder involved? Why it matters
- Does a separate system warn you before any certificate expires? Why it matters
- For each product version you will place on the European Union market after 8 December 2026, can you show which security updates it received and when? Why it matters
- If you supply the United States defence sector, is the evidence behind your last security self-assessment still current? Answer yes if you hold no such contracts. Why it matters
- Could someone list every manual step between merge and production in the last release, and say which steps actually catch problems? Why it matters
Reading your answers
- 7 or 8 yes: in good shape. Ask the questions again each quarter.
- 4 to 6 yes: pick the first "no" that has a date attached, and give it an owner.
- 3 or fewer yes: start with the dated items below, in date order.
Dates for your team
| Date | What changes | Details |
|---|---|---|
| Suspended 13 July 2026 | Cybersecurity Maturity Model Certification Phase 2 is suspended, with no restart date announced. Phase 1 self-assessment requirements remain in place.1 | Radar: Phase 2 suspended |
| Final since late July 2026 | The 2026 minimum elements for a software bill of materials update the 2021 baseline, with new requirements for component hash, licence, tool name and generation context.2 | The 2026 minimum elements |
| After 8 December 2026 | Product Liability Directive: Directive (EU) 2024/2853 applies to products placed on the market or put into service after 8 December 2026, and Member States must transpose it by 9 December 2026. Software counts as a product.3,4 | Radar: Product Liability Directive |
| 15 March 2027 | Public security certificates are limited to 100 days, and to 47 days from 15 March 2029.5 | 100-day certificates |
A note to forward to your team
Regulated delivery risk checklist
Please answer the eight yes or no questions in this note from what you know today. It takes about five minutes.
Reply by [date] with:
1. The number of "yes" answers (out of 8)
2. The numbers of the questions answered "no"
Owner: [name]
Note: https://stonetusker.com/insights/checklist-regulated-audit-first.htmlWant a second opinion?
Answer the eight questions with your team first. If you would like a second opinion, reply with two things only: the number of "yes" answers and the numbers of the questions answered "no". Nothing else is needed. Within five working days you receive a short written note on what to do first. It is free and confidential, and a call is optional.
The button opens an email to subeesh@stonetusker.com with the subject and the numbers to fill in. You can also use the contact page, or reply to the email or LinkedIn message that brought you here.
Next page for your situation
- The 2026 minimum elements for a software bill of materials: the 30-minute check behind questions 1 to 3.
- Delivery Deadline Radar: every dated item for your archetype, with a check for each.
Sources
- Department of Defense Chief Information Officer: About CMMC
- CISA: Updated minimum elements for a software bill of materials (29 July 2026)
- Official Journal of the European Union: Directive (EU) 2024/2853 on liability for defective products
- Official Journal of the European Union: Corrigendum to Directive (EU) 2024/2853 (7 May 2026)
- CA/Browser Forum: Baseline Requirements for TLS server certificates
About the author
Subeesh Sivanandan is the Founder and CEO of Stonetusker Systems. He has worked for more than 27 years in release engineering, DevOps, platform engineering & embedded Linux. His career includes serving as the Principal Engineer & Manager of Release Engineering at Stryker, alongside earlier roles at Nokia, VeriSign, and IP Infusion. LinkedIn profile.
Revision history (recent 3 updates)
Version 1.0, 29 October 2026. Every fact on this page is checked against a minimum of two sources each month.
| Version | Date | Change |
|---|---|---|
| 1.0 | 29 October 2026 | First edition |