Tag
Change Management
7 articles
Compliance frameworks
SOX change management controls
How SOX auditors test program change: the change population, testing and approval, developer access to production, emergency changes and config changes.
6 min read
Compliance frameworks
Computer system validation for SaaS
Who validates a SaaS system under FDA rules, which documents each side owns, and how to keep validation current when the vendor ships changes every month.
6 min read
Security engineering
Branch protection rules auditors look for
The branch protection settings that make code review a testable control, the bypass paths auditors probe, and the evidence that proves it held all period.
7 min read
Compliance frameworks
SOX IT general controls, explained
What SOX IT general controls are, why financial auditors test them, the four areas they cover, how systems get scoped in, and how they differ from SOC 2.
6 min read
Security engineering
Code review as a change management control
For most software teams, the pull request review is the change approval. What it must establish, which changes it must cover, and how auditors sample it.
6 min read
Privacy
Privacy by design under GDPR Article 25
What GDPR Article 25 requires of data protection by design and by default, how the EDPB reads it, and how to build evidence of it into your development work.
6 min read
Compliance frameworks
What the SOC 2 security criterion actually requires
The SOC 2 security category is nine series of common criteria, CC1 to CC9. What each one asks, what evidence auditors test, and what the criteria leave to you.
7 min read