Where should she document the risks associated with this technology so she can track the risk status and responses?
What are the procedures that must be defined for each software project to ensure that a sound SCM process is implemented?