Category
Compliance frameworks, page 3
How SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS actually work in practice, and what each one asks of an engineering team.
117 articles
Compliance frameworks
How to read a SOC 2 report as a buyer
A buyer's order for reading a vendor's SOC 2 report: the opinion, period, scope, carve-outs, user entity controls, and test results, and what to record.
6 min read
Compliance frameworks
The ISO 27001 management review, done properly
What ISO 27001 clause 9.3 requires of a management review, who must take part, how to prepare each input, and what the record needs to show your auditor.
6 min read
Compliance frameworks
DORA contract requirements for ICT services
The clauses DORA Article 30 requires in every ICT services contract, the extra terms for critical or important functions, and what providers should negotiate.
7 min read
Compliance frameworks
The HITRUST r2 interim assessment
What the HITRUST r2 interim assessment covers, when it falls, what your assessor tests, and how to keep year one of your certification from slipping.
6 min read
Compliance frameworks
ASV scans: what passes and what fails
PCI DSS requires a passing external scan from an Approved Scanning Vendor every quarter. How scope is set, what fails a scan, and how to dispute a finding.
6 min read
Compliance frameworks
The NIST 800-171 System Security Plan
What a NIST 800-171 system security plan must describe, a structure that works for assessors, and how to keep the plan accurate after the assessment.
6 min read
Compliance frameworks
What a SOC 2 bridge letter is and when buyers ask for one
What a SOC 2 bridge letter covers, who signs it, why it carries no auditor assurance, when buyers ask for one, and how to keep the gaps it covers short.
6 min read
Compliance frameworks
The FERPA school official exception
The three conditions a vendor must meet to receive student data as a FERPA school official, what direct control means for SaaS, and the redisclosure rules.
6 min read
Compliance frameworks
PHI vs ePHI: what counts as protected health information
How HIPAA defines PHI and ePHI, why the holder matters as much as the data, what the definitions exclude, and how to classify the edge cases SaaS teams hit.
6 min read
Compliance frameworks
Running the ISO 27001 internal audit
What ISO 27001 clause 9.2 requires of an internal audit, who can perform it, how to build the audit program, and how to run one audit from plan to report.
6 min read
Compliance frameworks
Carve-out vs inclusive: subservice organizations in SOC 2
How the carve-out and inclusive methods treat subservice organizations in a SOC 2, when each one fits, and the monitoring controls a carve-out requires.
6 min read
Compliance frameworks
NIST 800-171 Revision 2 vs Revision 3
What changed between NIST SP 800-171 Rev. 2 and Rev. 3, which revision your contract likely requires, and how to prepare for Rev. 3 without wasted work.
6 min read
Compliance frameworks
DORA resilience testing and TLPT
What DORA's testing program requires every year, which entities must run threat-led penetration tests, who may test, and what ICT providers must do.
6 min read
Compliance frameworks
HITRUST vs SOC 2 for healthcare buyers
How a HITRUST certification and a SOC 2 report differ in who issues them, what they test and how long they last, and how to tell which your buyer needs.
6 min read
Compliance frameworks
Building NIST CSF current and target profiles
How to build NIST CSF 2.0 current and target profiles: scoping, describing current practice with evidence, setting targets by risk, and planning gaps.
6 min read
Compliance frameworks
Network segmentation for PCI DSS
Segmentation is not a PCI DSS requirement, but without it your whole network is in scope. What counts as isolation, how to test it, and where it usually fails.
6 min read
Compliance frameworks
ISO 27001 surveillance audits: what to expect each year
What an ISO 27001 surveillance audit must cover, how the certification body samples across the three-year cycle, and how to run the year between audits.
6 min read
Compliance frameworks
FERPA for EdTech vendors
FERPA regulates schools, not vendors, yet it shapes every EdTech contract. How it reaches you, what counts as an education record, and the controls to run.
6 min read
Compliance frameworks
HIPAA breach notification: timelines and thresholds
When an incident is a HIPAA breach, when the 60-day clock starts, who must be told at the 500-person thresholds, and what business associates owe customers.
6 min read
Compliance frameworks
Complementary user entity controls, explained
What complementary user entity controls are, why SOC 2 reports list them, how to write ones auditors and buyers accept, and what to do with a vendor's list.
6 min read
Compliance frameworks
Scoping where CUI lives in your environment
How to trace where CUI enters and moves, sort assets into the CMMC scoping categories, choose between an enclave and the enterprise, and document the result.
6 min read
Compliance frameworks
Writing the SOC 2 system description
What the SOC 2 system description must contain under the AICPA's DC 200 criteria, how auditors test it, and how to write one that stays accurate.
6 min read
Compliance frameworks
ISO 27001 stage 1 vs stage 2 audits
What the certification body examines in an ISO 27001 stage 1 and stage 2 audit, how the two stages differ, what happens between them, and how to prepare.
6 min read
Compliance frameworks
NIST 800-171: protecting CUI in practice
What NIST SP 800-171 requires of contractors holding CUI, the requirements that take the most work, and the DFARS obligations that sit alongside them.
6 min read