Category
Compliance frameworks
How SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS actually work in practice, and what each one asks of an engineering team.
115 articles
Compliance frameworks
CMMC and cloud services: FedRAMP equivalency
When a cloud service holding CUI must be FedRAMP Moderate authorized or equivalent, what equivalency requires, and what to collect from your provider.
6 min read
Compliance frameworks
NIS2 incident reporting timelines
When an incident is significant under NIS2, what the early warning, notification and final report must contain, when each clock starts, and who else to tell.
6 min read
Compliance frameworks
SOX change management controls
How SOX auditors test program change: the change population, testing and approval, developer access to production, emergency changes and config changes.
6 min read
Compliance frameworks
PCI DSS requirement 10: logging and log review
What PCI DSS Requirement 10 says to log, the fields every entry needs, which logs need daily review, how long to keep them, and what assessors ask to see.
6 min read
Compliance frameworks
Corrective actions that close ISO 27001 findings
How to answer an ISO 27001 nonconformity so it closes: correction versus corrective action, a cause analysis that holds, and proof the fix worked.
6 min read
Compliance frameworks
What a SOC 3 report is for
A SOC 3 is the public summary of a SOC 2 examination. What it contains, what it deliberately leaves out, where it helps sales, and where buyers still want more.
6 min read
Compliance frameworks
FCI vs CUI: what CMMC protects
The definitions of Federal Contract Information and Controlled Unclassified Information, how marking works, and why the difference sets your CMMC level.
6 min read
Compliance frameworks
Computer system validation for SaaS
Who validates a SaaS system under FDA rules, which documents each side owns, and how to keep validation current when the vendor ships changes every month.
6 min read
Compliance frameworks
HIPAA workforce training that counts as evidence
The two HIPAA training requirements, who counts as workforce, the records an investigator or customer asks for, and how to prove that no one was missed.
6 min read
Compliance frameworks
Major vs minor nonconformities in ISO 27001
Where the major and minor grades come from, what pushes a finding into each, what each means for your certificate, and how to keep a stage 2 free of majors.
6 min read
Compliance frameworks
SOC 2 vs SOC 1: which report your customers need
SOC 1 serves your customers' financial auditors. SOC 2 serves their security teams. How to tell which one a request is really for, and when you need both.
6 min read
Compliance frameworks
CMMC for subcontractors in the defense supply chain
How CMMC reaches subcontractors through flow-down, why the level you need follows the information you receive, and what to settle with your prime first.
5 min read
Compliance frameworks
NIS2 cybersecurity risk management measures
The ten cybersecurity risk management measures in NIS2 Article 21, what each one asks for in practice, the evidence to keep, and how ISO 27001 maps to them.
6 min read
Compliance frameworks
Access to programs and data for SOX
The SOX ITGC access controls auditors test: provisioning, removal, access reviews, privileged access and segregation of duties, with the evidence each needs.
6 min read
Compliance frameworks
Mapping NIST CSF to ISO 27001
How NIST CSF 2.0 functions map to ISO 27001:2022 clauses and Annex A controls, where the mapping breaks down, and how one evidence set serves both.
6 min read
Compliance frameworks
PCI DSS requirement 8 and multi-factor authentication
PCI DSS 4.0 requires MFA for all access into the cardholder data environment. Which access paths need it, the exemptions, and how the MFA system must work.
6 min read
Compliance frameworks
ISO 27001 vs ISO 27002: what each document does
ISO 27001 sets the requirements you are certified against. ISO 27002 explains how to implement each control. How the two fit, and when to reach for each.
6 min read
Compliance frameworks
Part 11 audit trails and electronic signatures
What 21 CFR 11.10(e), 11.50, 11.70 and Subpart C ask of audit trails and e-signatures, how they meet SSO and MFA, and the design errors that fail review.
7 min read
Compliance frameworks
Addressable vs required: HIPAA encryption explained
What addressable means in the HIPAA Security Rule, where encryption sits in it, how it links to breach notification, and how to document each decision.
6 min read
Compliance frameworks
What drives the cost of a SOC 2 audit
The scope decisions, evidence habits, and internal effort that set what a SOC 2 audit costs, and which of them you can change before you sign anything.
6 min read
Compliance frameworks
Preparing for a CMMC assessment
A practical order of work for CMMC assessment prep: fix scope, assemble what the assessor reads first, build evidence per objective, and rehearse the room.
6 min read
Compliance frameworks
ISO 27001 for startups: a realistic first certification
What a small team needs for a first ISO 27001 certificate: a defensible scope, a working ISMS, the records auditors check, and the order to build it.
6 min read
Compliance frameworks
How to choose a SOC 2 audit firm
The checks that matter when picking a SOC 2 auditor: licensing, peer review, independence, who does the fieldwork, and what a proposal should commit to.
6 min read
Compliance frameworks
21 CFR Part 11 explained
What FDA's Part 11 covers, how predicate rules decide whether it applies to your records, and which controls the FDA's 2003 scope guidance still enforces.
7 min read