Uncontrolled permissions, active accounts, and access to sensitive information without clear review.
Critical knowledge concentrated in a few people, without defined procedures or replacements.
Informal processes and scattered evidence make it difficult to demonstrate consistent management.
Threats, incidents, and vulnerabilities without systematic treatment or clear responsibilities.
Security requirements, questionnaires, and contracts that demand reliable controls and evidence.
Close dates with incomplete documentation, vague responsibilities and little time to organize the management.
