Category
Compliance frameworks, page 2
How SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS actually work in practice, and what each one asks of an engineering team.
117 articles
Compliance frameworks
How to choose a SOC 2 audit firm
The checks that matter when picking a SOC 2 auditor: licensing, peer review, independence, who does the fieldwork, and what a proposal should commit to.
6 min read
Compliance frameworks
21 CFR Part 11 explained
What FDA's Part 11 covers, how predicate rules decide whether it applies to your records, and which controls the FDA's 2003 scope guidance still enforces.
7 min read
Compliance frameworks
NIS2 essential vs important entities
How NIS2 decides whether you are in scope, how it sorts entities into essential and important, and what the label changes for supervision and enforcement.
6 min read
Compliance frameworks
SOX IT general controls, explained
What SOX IT general controls are, why financial auditors test them, the four areas they cover, how systems get scoped in, and how they differ from SOC 2.
6 min read
Compliance frameworks
CMMC Level 2: self-assessment vs C3PAO assessment
Who decides which CMMC Level 2 assessment you face, what stays identical between a self-assessment and a C3PAO assessment, and where the two diverge.
6 min read
Compliance frameworks
The PCI DSS customized approach
The customized approach lets you meet a PCI DSS objective with your own control. What you must document, how assessors test it, and when it is worth it.
6 min read
Compliance frameworks
HIPAA audit logs: what to record and keep
What the Security Rule requires of audit controls, which events to log in systems holding ePHI, how to review them, and what it leaves to you on retention.
6 min read
Compliance frameworks
What a SOC 2 readiness assessment should cover
The eight areas a SOC 2 readiness assessment should cover, the outputs you should expect from it, and how to tell a useful assessment from a checklist.
6 min read
Compliance frameworks
Building an ISO 27001 risk treatment plan
What an ISO 27001 risk treatment plan must do, the fields each entry needs, how owner approval and residual risk acceptance work, and how to keep it live.
6 min read
Compliance frameworks
CMMC levels, explained
What CMMC Levels 1, 2 and 3 require, which information each protects, how each is assessed and affirmed, and how to tell which level your contract needs.
6 min read
Compliance frameworks
Choosing your SOC 2 Type II observation period
How to choose the length and dates of a SOC 2 Type II observation period: what each length allows, how control frequency limits it, and where to put the end.
6 min read
Compliance frameworks
FERPA vs COPPA for EdTech companies
FERPA regulates schools and COPPA regulates operators. How the two laws differ, when both apply to one product, and how school authorization fits between them.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Compliance frameworks
Writing an ISO 27001 scope statement
How to set ISO 27001 scope boundaries, write a scope statement your auditor and buyers can read, handle interfaces and dependencies, and avoid weak scopes.
6 min read
Compliance frameworks
DORA vs NIS2: which applies to you
How to tell whether DORA, NIS2 or both apply to your organization, how the EU resolves the overlap for financial entities, and where ICT providers sit.
6 min read
Compliance frameworks
HITRUST corrective action plans
When HITRUST requires a corrective action plan, what a good CAP contains, how to set dates you can meet, and how CAP progress is checked through the cycle.
6 min read
Compliance frameworks
NIST CSF implementation tiers explained
What the four NIST CSF tiers describe, from Partial to Adaptive, why they are not maturity scores, and how to choose and evidence a target tier that fits.
6 min read
Compliance frameworks
QSA vs ISA: who assesses PCI DSS
A QSA assesses any organization; an ISA assesses only its own employer. What each role can sign, who decides which you need, and how to choose a QSA firm.
6 min read
Compliance frameworks
The SPRS score, explained
How the NIST 800-171 SPRS score is calculated from 110 down, what Basic, Medium and High assessments mean, what you post, and how to keep the score honest.
6 min read
Compliance frameworks
SOC 2 exceptions and qualified opinions: what they mean
What a SOC 2 exception is, how auditors decide whether it changes the opinion, the four opinion types, and how to respond when your own report has findings.
6 min read
Compliance frameworks
Accredited certification bodies and why accreditation matters
How accreditation of ISO 27001 certification bodies works, what it does and does not guarantee, how to verify a certificate, and how to choose a body.
6 min read
Compliance frameworks
Student data privacy agreements, explained
What a student data privacy agreement contains, why districts require one, how standardized agreements work, and which clauses need operational work first.
6 min read
Compliance frameworks
The HIPAA minimum necessary standard
What HIPAA's minimum necessary standard requires for uses, disclosures and requests of PHI, where it does not apply, and how a SaaS vendor designs for it.
6 min read
Compliance frameworks
Writing a POA&M that assessors accept
The fields a plan of action and milestones needs, how to write milestones an assessor believes, and what a POA&M cannot do under DoD scoring and CMMC.
6 min read