Blog
Compliance engineering, page 9
What auditors actually ask for, how evidence collection works in practice, and where the frameworks overlap. Written by people who have been through it.
Audit readiness
Types of audit evidence, and which is strongest
Inquiry, observation, inspection and reperformance, ranked the way auditing standards rank them, and what that ranking means for the records you keep.
6 min read
Compliance frameworks
What the SOC 2 security criterion actually requires
The SOC 2 security category is nine series of common criteria, CC1 to CC9. What each one asks, what evidence auditors test, and what the criteria leave to you.
7 min read
Security engineering
SSO as a compliance control
Single sign-on makes access controls cheaper to run and easier to prove, but only for the apps behind it. What SSO covers, what it misses, and what to test.
6 min read
Risk and vendors
Building a risk register auditors accept
The fields a risk register needs, how to write risks that are not missing controls in disguise, and the register mistakes auditors turn into findings.
7 min read
Trust and sales
SIG, CAIQ and custom questionnaires compared
How the SIG, the CAIQ and a buyer's custom questionnaire differ in origin, structure and use, and when to complete a standard one before anyone asks.
6 min read
Security engineering
Enforcing MFA for every user
Turning MFA on is easy. Proving it covers every account is not. Where coverage breaks, which factors hold up, and the MFA evidence auditors actually test.
7 min read
Audit readiness
Planning your first audit timeline
Plan a first SOC 2 or ISO 27001 audit backward from the date it is needed: the steps that cannot be compressed, what each waits on, and where plans slip.
6 min read
Compliance frameworks
ISO 27701 explained: extending ISO 27001 to privacy
What ISO 27701 adds to an ISO 27001 ISMS, how controller and processor controls fit, why the 2025 revision matters, and who should pursue it.
6 min read
Compliance frameworks
DORA explained for ICT service providers
What DORA requires of EU financial entities, how those duties reach their ICT providers through contracts, registers and testing, and what to prepare first.
7 min read
Compliance frameworks
HITRUST e1, i1 and r2 compared
What the HITRUST e1, i1 and r2 assessments each test, how they are scored, how long each certification lasts, and how to pick the one your buyers accept.
6 min read
Compliance frameworks
NIST 800-53 control families, explained
What each of the 20 control families in NIST SP 800-53 Rev. 5 covers, how a single control is built, and how to read the catalog without getting lost.
6 min read
Compliance frameworks
NIST CSF 2.0 and its six functions
What NIST CSF 2.0 contains: the six functions and their categories, how subcategories are written, where profiles and tiers fit, and what it is not.
6 min read
AI governance
What ISO 42001 certifies
ISO/IEC 42001 certifies an AI management system, not a model. What the certificate attests, what it leaves out, and how to read one a vendor sends.
6 min read
Compliance frameworks
What changed in PCI DSS 4.0
PCI DSS 4.0 added a customized approach, targeted risk analysis and new requirements for MFA and payment pages. What changed, and what 4.0.1 clarified.
6 min read
Privacy
The six GDPR lawful bases, and how to choose one
What each of the six Article 6 lawful bases requires, which ones a SaaS company can rely on, and how to choose and record a basis before processing.
7 min read
Compliance frameworks
The HIPAA Security Rule's three safeguard types
What the HIPAA Security Rule's administrative, physical and technical safeguards each cover, how addressable specs work, and where the work starts.
7 min read
Compliance frameworks
What an ISMS is, in plain terms
An ISMS is the management system ISO 27001 certifies, not a tool or a binder. What it is made of, what clauses 4 to 10 require, and where Annex A fits.
6 min read
Compliance frameworks
The SOC 2 trust services criteria, explained one by one
What each of the five SOC 2 trust services categories covers, which one is required, how the criteria are numbered, and how to decide what is in scope.
7 min read