What is actually running on your Drupal websites?

Ivan Grynenko — Sun, 25 Oct 2026 00:00:00 GMT

A successful UAT check shows what was tested in that environment; it does not prove what production reports after a deployment or rollback. This article explains how recurring production inventory and assessment can support release assurance across a Drupal estate, and why teams should distinguish inventory freshness, assessment coverage and deployment evidence. It describes the capabilities and limitations of TrueCMS’s Sentinel Connector product, including why reporting does not replace functional testing or independently prove every file on a server. Missing or stale observations also need attention: they cannot establish the current state of a site.

GovCMS PaaS security patching: how to meet the 48-hour Essential Eight timeframe

Ivan Grynenko — Mon, 19 Oct 2026 00:00:00 GMT

On GovCMS PaaS, the agency is responsible for Drupal application security updates. Meeting an applicable 48-hour patching timeframe depends on prepared testing, a working release pipeline and evidence of the production outcome. This practical runbook covers triage, vendor mitigations, controlled releases, testing and production verification. It also explains how to distinguish Drupal risk labels and operational recommendations from the applicable Essential Eight controls, and what evidence to retain when reporting a completed update or an exception. It recommends confirming the interpretation with an agency security adviser and retaining release records for each affected site.

TrueCMS Drupal insights

What is actually running on your Drupal websites?

GovCMS PaaS security patching: how to meet the 48-hour Essential Eight timeframe