Editorial Policy & AI Transparency
Q-Day Audits covers topics affecting operational security, reliability, and financial safety. Every guide is governed by strict human verification rules before publication.
- Named human review: Every published guide names its human reviewer (Evelyn Mercer, Principal Cryptographic Governance & GRC Editor) and displays a visible “Last reviewed” date that changes only when substantive content is re-verified.
- How AI is used (draft-only rule): Generative AI tools may assist with initial research outlines or formatting inside an offline
/drafts/folder only. Automatic publishing is permanently disabled. No page is published until a human editor checks every claim. - Primary source requirement: Factual claims must link directly to primary sources (NIST FIPS publications, NSA advisories, official vendor status pages, court filings, or government consumer agencies such as Scamwatch, ACCC, FTC, SEC, and IC3), and the reviewer opens each link before approval.
- Scheduled maintenance: All regulatory mandate timelines, CycloneDX v1.6 schema references, audit scoping weights, and RFP clauses are reviewed every 3 months, or sooner whenever NIST, NSA, OMB, ENISA, or the Australian Signals Directorate issues updated guidance.
- Named-party safeguards: Content mentioning named organisations or individuals in regulatory or incident contexts must mirror the exact procedural posture of the official source (for example, “alleged”, “charged”, or “settled without admitting or denying”) and is never auto-generated.