TrustLynce Editorial Team, page 3
Compliance and security writers
The TrustLynce team writes about SOC 2, ISO 27001, HIPAA, GDPR and the work underneath them: scoping, evidence, controls, audits and security reviews. Guidance here is general information, not legal or audit advice.
213 articles
Compliance frameworks
SOX IT general controls, explained
What SOX IT general controls are, why financial auditors test them, the four areas they cover, how systems get scoped in, and how they differ from SOC 2.
6 min read
Compliance frameworks
CMMC Level 2: self-assessment vs C3PAO assessment
Who decides which CMMC Level 2 assessment you face, what stays identical between a self-assessment and a C3PAO assessment, and where the two diverge.
6 min read
AI governance
Governing AI agents with scoped access
How to govern AI agents that act on your systems: their own identities, task-scoped permissions, approval gates for risky actions, and a usable trail.
6 min read
Compliance frameworks
The PCI DSS customized approach
The customized approach lets you meet a PCI DSS objective with your own control. What you must document, how assessors test it, and when it is worth it.
6 min read
Privacy
Data minimization in product design
How to apply data minimization while a feature is being designed: field-level purpose checks, logs, analytics, test data, and the evidence it happened.
6 min read
Compliance frameworks
HIPAA audit logs: what to record and keep
What the Security Rule requires of audit controls, which events to log in systems holding ePHI, how to review them, and what it leaves to you on retention.
6 min read
Security engineering
Code review as a change management control
For most software teams, the pull request review is the change approval. What it must establish, which changes it must cover, and how auditors sample it.
6 min read
Compliance frameworks
What a SOC 2 readiness assessment should cover
The eight areas a SOC 2 readiness assessment should cover, the outputs you should expect from it, and how to tell a useful assessment from a checklist.
6 min read
Audit readiness
Screenshots vs system-generated evidence
When a screenshot is acceptable audit evidence, what it must show, why exports and system reports usually serve better, and how auditors test the reports.
6 min read
Compliance frameworks
Building an ISO 27001 risk treatment plan
What an ISO 27001 risk treatment plan must do, the fields each entry needs, how owner approval and residual risk acceptance work, and how to keep it live.
6 min read
Risk and vendors
Managing SaaS sprawl
How to find the SaaS apps your teams already use, triage them into an owned inventory, retire the extras, and stop new sprawl without blocking the business.
6 min read
Trust and sales
Security reviews for startups without a report yet
How a startup with no SOC 2 report can still pass a buyer's security review: what to offer instead, how to present the audit timeline, and what to avoid.
6 min read
Compliance frameworks
CMMC levels, explained
What CMMC Levels 1, 2 and 3 require, which information each protects, how each is assessed and affirmed, and how to tell which level your contract needs.
6 min read
Privacy
Cookie consent under GDPR and ePrivacy
Why cookie consent rests on the ePrivacy Directive, what the GDPR adds, how narrow the strictly necessary exemption is, and how to test your banner.
6 min read
Security engineering
Business continuity and disaster recovery plans
Continuity keeps the business running; recovery restores the technology. How to run an impact analysis, map dependencies, write both plans, and test them.
6 min read
Compliance frameworks
Choosing your SOC 2 Type II observation period
How to choose the length and dates of a SOC 2 Type II observation period: what each length allows, how control frequency limits it, and where to put the end.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Compliance frameworks
FERPA vs COPPA for EdTech companies
FERPA regulates schools and COPPA regulates operators. How the two laws differ, when both apply to one product, and how school authorization fits between them.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Compliance frameworks
Writing an ISO 27001 scope statement
How to set ISO 27001 scope boundaries, write a scope statement your auditor and buyers can read, handle interfaces and dependencies, and avoid weak scopes.
6 min read
AI governance
Keeping an AI system inventory
What belongs in an AI system inventory, the fields worth keeping, where entries come from, and the change triggers that stop it going stale in months.
6 min read
Compliance frameworks
DORA vs NIS2: which applies to you
How to tell whether DORA, NIS2 or both apply to your organization, how the EU resolves the overlap for financial entities, and where ICT providers sit.
6 min read
Compliance frameworks
HITRUST corrective action plans
When HITRUST requires a corrective action plan, what a good CAP contains, how to set dates you can meet, and how CAP progress is checked through the cycle.
6 min read
Compliance frameworks
NIST CSF implementation tiers explained
What the four NIST CSF tiers describe, from Partial to Adaptive, why they are not maturity scores, and how to choose and evidence a target tier that fits.
6 min read