Category
Compliance frameworks, page 5
How SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS actually work in practice, and what each one asks of an engineering team.
117 articles
Compliance frameworks
The SOC 2 confidentiality criterion in practice
What C1.1 and C1.2 ask in practice: defining confidential data, finding every copy, deleting it on time at contract end, and the records an auditor samples.
6 min read
Compliance frameworks
ISO 27001 clause 6: risk assessment and treatment
What ISO 27001 clause 6.1 requires of your risk assessment and treatment process, step by step, the records it must leave, and where auditors find gaps.
6 min read
Compliance frameworks
Tailoring NIST 800-53 controls
The tailoring activities NIST SP 800-53B describes, how to set parameter values and compensating controls, and how to record decisions a reviewer accepts.
6 min read
Compliance frameworks
The DORA ICT risk management framework
What Articles 5 to 16 of DORA require in an ICT risk management framework, who must own it, how often it is reviewed, and the evidence a supervisor expects.
7 min read
Compliance frameworks
Preparing for a HITRUST validated assessment
The steps before HITRUST fieldwork: fixing scope, choosing an assessor, running a readiness assessment, building evidence, and what happens at QA.
6 min read
Compliance frameworks
Choosing the right PCI DSS self-assessment questionnaire
Which PCI DSS self-assessment questionnaire fits depends on how you take card payments, not your size. The SAQ types, their eligibility tests, and the traps.
6 min read
Compliance frameworks
Should you include availability in your SOC 2?
How to decide whether availability belongs in your SOC 2: what it adds beyond security, the commitments that trigger it, and the evidence auditors will test.
6 min read
Compliance frameworks
ISO 27701 controller and processor controls
How to decide which ISO 27701 role you hold per activity, what the controller and processor control sets ask for, and the evidence each one has to produce.
6 min read
Compliance frameworks
HIPAA administrative safeguards in practice
How to run each HIPAA administrative safeguard as a working process: who owns it, what it produces, and the dated records that show it operated all year.
6 min read
Compliance frameworks
ISO 27001 clause 4: context and interested parties
What ISO 27001 clauses 4.1 to 4.4 require, how to record your issues and interested parties so they drive scope and risk, and what auditors look for.
6 min read
Compliance frameworks
Choosing a NIST 800-53 baseline
How FIPS 199 categorization and the high-water mark decide your NIST 800-53 baseline, who makes the call, and the categorization mistakes to avoid.
6 min read
Compliance frameworks
What the SOC 2 security criterion actually requires
The SOC 2 security category is nine series of common criteria, CC1 to CC9. What each one asks, what evidence auditors test, and what the criteria leave to you.
7 min read
Compliance frameworks
ISO 27701 explained: extending ISO 27001 to privacy
What ISO 27701 adds to an ISO 27001 ISMS, how controller and processor controls fit, why the 2025 revision matters, and who should pursue it.
6 min read
Compliance frameworks
DORA explained for ICT service providers
What DORA requires of EU financial entities, how those duties reach their ICT providers through contracts, registers and testing, and what to prepare first.
7 min read
Compliance frameworks
HITRUST e1, i1 and r2 compared
What the HITRUST e1, i1 and r2 assessments each test, how they are scored, how long each certification lasts, and how to pick the one your buyers accept.
6 min read
Compliance frameworks
NIST 800-53 control families, explained
What each of the 20 control families in NIST SP 800-53 Rev. 5 covers, how a single control is built, and how to read the catalog without getting lost.
6 min read
Compliance frameworks
NIST CSF 2.0 and its six functions
What NIST CSF 2.0 contains: the six functions and their categories, how subcategories are written, where profiles and tiers fit, and what it is not.
6 min read
Compliance frameworks
What changed in PCI DSS 4.0
PCI DSS 4.0 added a customized approach, targeted risk analysis and new requirements for MFA and payment pages. What changed, and what 4.0.1 clarified.
6 min read
Compliance frameworks
The HIPAA Security Rule's three safeguard types
What the HIPAA Security Rule's administrative, physical and technical safeguards each cover, how addressable specs work, and where the work starts.
7 min read
Compliance frameworks
What an ISMS is, in plain terms
An ISMS is the management system ISO 27001 certifies, not a tool or a binder. What it is made of, what clauses 4 to 10 require, and where Annex A fits.
6 min read
Compliance frameworks
The SOC 2 trust services criteria, explained one by one
What each of the five SOC 2 trust services categories covers, which one is required, how the criteria are numbered, and how to decide what is in scope.
7 min read