Document your key software dependencies and their update status

Documenting your key software dependencies and their update status creates a real reference of exactly what libraries, frameworks, and plugins your site depends on and whether each is current, turning a future security advisory into something actionable rather than a guessing game.

When a security advisory is published about a specific library, knowing immediately whether you use it and what version is the difference between a fast, confident response and a scramble to figure out your actual exposure.

How to do it

1. 1
   List every significant dependency your site relies on

   Core framework, major libraries, CMS plugins, anything meaningful to your actual functionality.
2. 2
   Note the current version of each

   What you are actually running right now.
3. 3
   Note your update status and process for each

   How you would actually update it, and whether that is automated or manual.
4. 4
   Keep this document genuinely current

   Update it as dependencies change, not just once and forgotten.