Blog
Compliance engineering, page 4
What auditors actually ask for, how evidence collection works in practice, and where the frameworks overlap. Written by people who have been through it.
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read
Privacy
GDPR for US SaaS companies
When the GDPR reaches a US SaaS company, the controller and processor roles you hold, and the obligations to put in place first, in a practical order.
6 min read
Compliance frameworks
SOC 2 exceptions and qualified opinions: what they mean
What a SOC 2 exception is, how auditors decide whether it changes the opinion, the four opinion types, and how to respond when your own report has findings.
6 min read
Trust and sales
Explaining shared responsibility to customers
How a SaaS provider explains which security controls it runs, which its cloud provider runs, and which customers own, in a matrix and in questionnaire answers.
6 min read
Audit readiness
Continuous monitoring vs point-in-time audits
What an audit covers that monitoring cannot, what monitoring catches that an audit finds too late, and how auditors treat the output of your monitoring.
6 min read
Compliance frameworks
Accredited certification bodies and why accreditation matters
How accreditation of ISO 27001 certification bodies works, what it does and does not guarantee, how to verify a certificate, and how to choose a body.
6 min read
Security engineering
Running a tabletop exercise
A tabletop exercise is how most teams test an incident response plan. How to set objectives, write injects, run the session, and produce a report that counts.
6 min read
Compliance frameworks
Student data privacy agreements, explained
What a student data privacy agreement contains, why districts require one, how standardized agreements work, and which clauses need operational work first.
6 min read
Compliance frameworks
The HIPAA minimum necessary standard
What HIPAA's minimum necessary standard requires for uses, disclosures and requests of PHI, where it does not apply, and how a SaaS vendor designs for it.
6 min read
Compliance frameworks
Writing a POA&M that assessors accept
The fields a plan of action and milestones needs, how to write milestones an assessor believes, and what a POA&M cannot do under DoD scoring and CMMC.
6 min read
Compliance frameworks
How to read a SOC 2 report as a buyer
A buyer's order for reading a vendor's SOC 2 report: the opinion, period, scope, carve-outs, user entity controls, and test results, and what to record.
6 min read
AI governance
The AI questions now in security questionnaires
The AI questions customers add to security questionnaires, what each one is testing, the facts to gather before answering, and the answers that go wrong.
6 min read
Audit readiness
What auditors actually ask for
Fieldwork is mostly a request list. Knowing the shape of that list in advance turns a stressful three weeks into a week of sending things you already have.
3 min read
Privacy
Privacy by design under GDPR Article 25
What GDPR Article 25 requires of data protection by design and by default, how the EDPB reads it, and how to build evidence of it into your development work.
6 min read
Audit readiness
Running several audits on one calendar
How to fit SOC 2, ISO 27001 and PCI DSS into one year: each audit's fixed dates, aligning or staggering fieldwork, and annual controls that serve all three.
6 min read
Risk and vendors
Offboarding a vendor
How to offboard a vendor: inventory what it holds, export data, revoke every credential and DNS record, confirm deletion, update records, and keep evidence.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
Compliance frameworks
The ISO 27001 management review, done properly
What ISO 27001 clause 9.3 requires of a management review, who must take part, how to prepare each input, and what the record needs to show your auditor.
6 min read
Compliance frameworks
DORA contract requirements for ICT services
The clauses DORA Article 30 requires in every ICT services contract, the extra terms for critical or important functions, and what providers should negotiate.
7 min read
Trust and sales
Security questionnaires without the fire drill
A questionnaire is the same forty questions in a new spreadsheet. Answer them once, keep the answers current, and the sales cycle stops stalling on them.
3 min read
Compliance frameworks
The HITRUST r2 interim assessment
What the HITRUST r2 interim assessment covers, when it falls, what your assessor tests, and how to keep year one of your certification from slipping.
6 min read
Compliance frameworks
ASV scans: what passes and what fails
PCI DSS requires a passing external scan from an Approved Scanning Vendor every quarter. How scope is set, what fails a scan, and how to dispute a finding.
6 min read
Trust and sales
Sharing penetration test results with buyers
What buyers want from your penetration test, what a summary letter should contain, how to discuss open findings honestly, and when to share more detail.
6 min read
Compliance frameworks
The NIST 800-171 System Security Plan
What a NIST 800-171 system security plan must describe, a structure that works for assessors, and how to keep the plan accurate after the assessment.
6 min read