TrustLynce Editorial Team, page 8
Compliance and security writers
The TrustLynce team writes about SOC 2, ISO 27001, HIPAA, GDPR and the work underneath them: scoping, evidence, controls, audits and security reviews. Guidance here is general information, not legal or audit advice.
213 articles
Compliance frameworks
The ISO 27001:2022 Annex A themes, explained
How the 93 Annex A controls in ISO 27001:2022 are grouped into four themes, which 11 controls are new, and how ISO 27002 attributes let you sort them.
5 min read
Trust and sales
What to put on a Trust Center
The documents and facts a Trust Center should carry, which belong in public view and which behind an NDA, and what should never be published there at all.
6 min read
Compliance frameworks
NIST 800-53 Rev 5 privacy controls
How NIST SP 800-53 Rev. 5 builds privacy into the catalog: the PT family, privacy controls in other families, the privacy baseline, and who owns what.
5 min read
Compliance frameworks
SOC 2 Type I vs Type II: what actually differs
Type I reports on design at a point in time. Type II reports on operation over a window. That single difference changes scoping, evidence and your timeline.
3 min read
Audit readiness
What happens in an audit walkthrough
What an auditor does in a control walkthrough, what they are testing, what to have open on screen, and the mistakes that turn a one-hour session into three.
6 min read
Compliance frameworks
ISO 27701 and GDPR: how they map
Where ISO 27701 controls line up with GDPR articles, where the regulation asks for more than the standard, and how to use the mapping without overclaiming.
6 min read
Compliance frameworks
HIPAA technical safeguards for SaaS teams
What each HIPAA technical safeguard means inside a multi-tenant SaaS product, where ePHI escapes your controls, and the evidence a healthcare buyer expects.
6 min read
Risk and vendors
Writing a risk appetite statement
How to write a security risk appetite statement leadership will approve: appetite vs tolerance, a structure by category, sample wording, and common faults.
6 min read
Compliance frameworks
The SOC 2 confidentiality criterion in practice
What C1.1 and C1.2 ask in practice: defining confidential data, finding every copy, deleting it on time at contract end, and the records an auditor samples.
6 min read
Security engineering
Managing privileged access
Admin accounts carry most of your access risk. How to find them, separate them, grant elevation for hours instead of years, and log what privileged users do.
6 min read
Privacy
When a DPIA is required under GDPR
How to tell whether GDPR Article 35 requires a DPIA: the three named cases, the nine screening criteria, national lists, and what to record if you skip.
6 min read
Compliance frameworks
ISO 27001 clause 6: risk assessment and treatment
What ISO 27001 clause 6.1 requires of your risk assessment and treatment process, step by step, the records it must leave, and where auditors find gaps.
6 min read
Compliance frameworks
Tailoring NIST 800-53 controls
The tailoring activities NIST SP 800-53B describes, how to set parameter values and compensating controls, and how to record decisions a reviewer accepts.
6 min read
Audit readiness
How auditors sample controls
How SOC 2 auditors set sample sizes, select items from your population and handle a failed sample, and how ISO 27001 certification audits sample instead.
6 min read
Compliance frameworks
The DORA ICT risk management framework
What Articles 5 to 16 of DORA require in an ICT risk management framework, who must own it, how often it is reviewed, and the evidence a supervisor expects.
7 min read
Compliance frameworks
Preparing for a HITRUST validated assessment
The steps before HITRUST fieldwork: fixing scope, choosing an assessor, running a readiness assessment, building evidence, and what happens at QA.
6 min read
Compliance frameworks
Choosing the right PCI DSS self-assessment questionnaire
Which PCI DSS self-assessment questionnaire fits depends on how you take card payments, not your size. The SAQ types, their eligibility tests, and the traps.
6 min read
Compliance frameworks
Should you include availability in your SOC 2?
How to decide whether availability belongs in your SOC 2: what it adds beyond security, the commitments that trigger it, and the evidence auditors will test.
6 min read
AI governance
Building an AI management system
A practical build order for an ISO/IEC 42001 AI management system: scope, policy, risk and impact methods, controls, and the first full audit cycle.
6 min read
Security engineering
Least privilege in practice
Every framework asks for least privilege and none says how. Designing roles, finding excess access, separating duties on a small team, and proving all of it.
6 min read
Trust and sales
Building a security answer library
How to structure a security answer library: the fields each entry needs, how to seed it from past questionnaires, and the review rules that keep it true.
6 min read
Compliance frameworks
ISO 27701 controller and processor controls
How to decide which ISO 27701 role you hold per activity, what the controller and processor control sets ask for, and the evidence each one has to produce.
6 min read
Compliance frameworks
HIPAA administrative safeguards in practice
How to run each HIPAA administrative safeguard as a working process: who owns it, what it produces, and the dated records that show it operated all year.
6 min read
Risk and vendors
Risk scoring: likelihood and impact
How to build likelihood and impact scales two people apply the same way, how to combine them without false precision, and how auditors test your scores.
6 min read