Tag
Vendor Risk, page 2
33 articles
Compliance frameworks
HITRUST inheritance from cloud providers
How HITRUST inheritance works, what you can and cannot inherit from a cloud provider, full versus shared requirements, and the mistakes that cost scores.
6 min read
Risk and vendors
Vendor tiering by data access
How to tier vendors by the data and systems they can reach, the intake questions that set a tier, what each tier triggers, and edge cases that mislead.
6 min read
Privacy
Transfer impact assessments after Schrems II
What a transfer impact assessment must show after Schrems II, the EDPB's six steps, how the Data Privacy Framework changes US transfers, and what to record.
6 min read
Privacy
Standard contractual clauses for international transfers
How the 2021 EU standard contractual clauses work: choosing a module, completing the annexes, the clauses you cannot change, and the ongoing duties.
6 min read
Compliance frameworks
Business associate agreements: what to check before signing
What HIPAA requires every business associate agreement to contain, the clauses customers add on top, and how to test whether you can perform each.
6 min read
Compliance frameworks
What the Govern function added in NIST CSF 2.0
Which parts of the NIST CSF 2.0 Govern function moved from version 1.1, which are new, and what each of the six Govern categories asks you to produce.
6 min read
Privacy
What belongs in a GDPR data processing agreement
The terms Article 28(3) makes mandatory in every DPA, what each one commits a processor to in practice, and the clauses worth negotiating beyond the minimum.
6 min read
Trust and sales
SIG, CAIQ and custom questionnaires compared
How the SIG, the CAIQ and a buyer's custom questionnaire differ in origin, structure and use, and when to complete a standard one before anyone asks.
6 min read
Compliance frameworks
DORA explained for ICT service providers
What DORA requires of EU financial entities, how those duties reach their ICT providers through contracts, registers and testing, and what to prepare first.
7 min read