Category
Compliance frameworks, page 4
How SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS actually work in practice, and what each one asks of an engineering team.
117 articles
Compliance frameworks
Why the same control appears in four frameworks
SOC 2, ISO 27001, HIPAA and PCI DSS ask overlapping questions in different words. Mapping once and reusing the evidence is what makes the second one fast.
3 min read
Compliance frameworks
What an ISO 27701 certification audit involves
How an ISO 27701 certification audit runs: choosing a certification body, stage 1 and stage 2, what gets sampled, nonconformities, and surveillance.
6 min read
Compliance frameworks
The HIPAA risk analysis requirement
What the HIPAA Security Rule's risk analysis must cover, the elements HHS guidance expects, how to scope all ePHI, and what is often mistaken for one.
6 min read
Compliance frameworks
DORA third-party risk and the register of information
How DORA's Articles 28 and 29 govern ICT third-party risk, what the register of information must hold, and how to assess, monitor and exit ICT providers.
6 min read
Compliance frameworks
HITRUST inheritance from cloud providers
How HITRUST inheritance works, what you can and cannot inherit from a cloud provider, full versus shared requirements, and the mistakes that cost scores.
6 min read
Compliance frameworks
Tokenization and PCI DSS scope
Tokenization takes systems out of PCI DSS scope only under certain conditions. Where the vault sits, who can detokenize, and what assessors check in a design.
6 min read
Compliance frameworks
How to scope your first SOC 2 report
The seven scoping decisions for a first SOC 2: services, system boundaries, categories, report type, vendors, and customer duties, agreed before the audit.
6 min read
Compliance frameworks
Moving from ISO 27001:2013 to the 2022 edition
The ISO 27001:2013 transition period is over. What changed in the clauses and Annex A, where 2013 leftovers hide in an ISMS, and how to check for them.
6 min read
Compliance frameworks
Continuous monitoring under NIST 800-53
What NIST 800-53 control CA-7 requires, how to set monitoring frequencies, which controls feed it, and how monitoring results turn into risk decisions.
5 min read
Compliance frameworks
The SOC 2 privacy criterion compared with GDPR
How the SOC 2 privacy criteria P1 to P8 line up against GDPR, where they overlap, what GDPR requires that SOC 2 never tests, and when to include privacy.
6 min read
Compliance frameworks
Building a privacy information management system on your ISMS
A step-by-step plan for extending an ISO 27001 ISMS into an ISO 27701 PIMS: roles, scope, privacy risk, controls, and the management review changes.
6 min read
Compliance frameworks
Business associate agreements: what to check before signing
What HIPAA requires every business associate agreement to contain, the clauses customers add on top, and how to test whether you can perform each.
6 min read
Compliance frameworks
How to write a Statement of Applicability
What ISO 27001 requires in a Statement of Applicability, the columns worth adding, how to justify inclusions and exclusions, and how to keep it current.
6 min read
Compliance frameworks
Writing control implementation statements
How to write NIST 800-53 implementation statements an assessor can test: cover every part and parameter, name the mechanism, and handle inherited controls.
6 min read
Compliance frameworks
DORA incident reporting
How DORA defines a major ICT-related incident, the classification criteria, the three reports owed to supervisors, and the runbook that meets each deadline.
6 min read
Compliance frameworks
HITRUST maturity scoring in the r2 assessment
How the r2 scores each requirement across policy, procedure, implemented, measured and managed, what evidence moves a score, and where effort pays off.
6 min read
Compliance frameworks
What the Govern function added in NIST CSF 2.0
Which parts of the NIST CSF 2.0 Govern function moved from version 1.1, which are new, and what each of the six Govern categories asks you to produce.
6 min read
Compliance frameworks
Reducing your PCI DSS scope
Every in-scope system must meet every applicable PCI DSS requirement. How scope works, the options that shrink it, and the ones that only look like they do.
6 min read
Compliance frameworks
SOC 2 processing integrity: who needs it and why
Which services should include processing integrity in a SOC 2, how its five criteria turn into controls on inputs, processing, and outputs, and what it costs.
6 min read
Compliance frameworks
The ISO 27001:2022 Annex A themes, explained
How the 93 Annex A controls in ISO 27001:2022 are grouped into four themes, which 11 controls are new, and how ISO 27002 attributes let you sort them.
5 min read
Compliance frameworks
NIST 800-53 Rev 5 privacy controls
How NIST SP 800-53 Rev. 5 builds privacy into the catalog: the PT family, privacy controls in other families, the privacy baseline, and who owns what.
5 min read
Compliance frameworks
SOC 2 Type I vs Type II: what actually differs
Type I reports on design at a point in time. Type II reports on operation over a window. That single difference changes scoping, evidence and your timeline.
3 min read
Compliance frameworks
ISO 27701 and GDPR: how they map
Where ISO 27701 controls line up with GDPR articles, where the regulation asks for more than the standard, and how to use the mapping without overclaiming.
6 min read
Compliance frameworks
HIPAA technical safeguards for SaaS teams
What each HIPAA technical safeguard means inside a multi-tenant SaaS product, where ePHI escapes your controls, and the evidence a healthcare buyer expects.
6 min read