using-fianu-best-practices

Decide whether one control should perform multiple evaluations or whether each evaluation needs its own control, based on whether assets should pass one evaluation while failing another. Group evaluations under a single control when one policy manages all requirements, and split them when subsets of policy change at different rates.

Name controls after the activity or item being evaluated, such as Code Coverage or SBOM, not after the vendor or tool producing the evidence. Vendor-neutral names keep the control requirement stable when enterprises switch DevSecOps platforms.

Choose the asset type performing the control activity: repository for controls like Code Review and Code Coverage, artifact for Container Scan or Artifact Signature, and release for cross-asset validations like Regression Tests. Abstract asset scopes suit time-based controls such as annual Risk Reviews.

Policy template keys cannot start with a number, accept only alphanumeric characters and underscores, are case sensitive, and separate words with underscores. Templates should prioritize readability so users understand what the control evaluates and how.

Large enterprises should use 3-6 domains and avoid exceeding 10, while smaller companies should aim for 1-3. Collections should number between 5 and 20 depending on control count, SDLC coverage, and stakeholder ownership.

A release becomes immutable when it is formally closed after final approval. Its contents, documentation, approvals, and compliance status are locked as a permanent audit artifact, and any further changes require creating a new release.