Tag
Audit Readiness
82 articles
Compliance frameworks
Mapping HIPAA to SOC 2 controls
A working map from HIPAA Security Rule standards to SOC 2 criteria, where the two diverge, and how to run one control set that serves both obligations.
5 min read
Compliance frameworks
The policies a SOC 2 audit expects to see
The criteria never list required policies, yet auditors expect a familiar set. Which policies to write, what each must say, and how auditors test them.
6 min read
Compliance frameworks
SOX change management controls
How SOX auditors test program change: the change population, testing and approval, developer access to production, emergency changes and config changes.
6 min read
Compliance frameworks
Corrective actions that close ISO 27001 findings
How to answer an ISO 27001 nonconformity so it closes: correction versus corrective action, a cause analysis that holds, and proof the fix worked.
6 min read
Audit readiness
Running a mock audit
A mock audit tests whether you can produce evidence under audit conditions. Who should play the auditor, what to scope, how to run it, and how to use findings.
6 min read
Compliance frameworks
Major vs minor nonconformities in ISO 27001
Where the major and minor grades come from, what pushes a finding into each, what each means for your certificate, and how to keep a stage 2 free of majors.
6 min read
Audit readiness
An audit readiness checklist
A working checklist for the weeks before an audit: scope, documents, owners, populations, people, vendors and logistics, with what each item must show.
6 min read
Compliance frameworks
SOC 2 vs SOC 1: which report your customers need
SOC 1 serves your customers' financial auditors. SOC 2 serves their security teams. How to tell which one a request is really for, and when you need both.
6 min read
Compliance frameworks
Access to programs and data for SOX
The SOX ITGC access controls auditors test: provisioning, removal, access reviews, privileged access and segregation of duties, with the evidence each needs.
6 min read
Compliance frameworks
PCI DSS requirement 8 and multi-factor authentication
PCI DSS 4.0 requires MFA for all access into the cardholder data environment. Which access paths need it, the exemptions, and how the MFA system must work.
6 min read
AI governance
Human approval for AI-drafted compliance work
How to approve AI-drafted policies, questionnaire answers, and control text so the approval means something: what to check, what to record, what not to draft.
6 min read
Compliance frameworks
ISO 27001 vs ISO 27002: what each document does
ISO 27001 sets the requirements you are certified against. ISO 27002 explains how to implement each control. How the two fit, and when to reach for each.
6 min read
Audit readiness
Assigning control owners who stay engaged
Naming a control owner takes a minute; keeping them engaged for an audit period is the real work. How to pick owners, define the role, and survive handovers.
6 min read
Compliance frameworks
What drives the cost of a SOC 2 audit
The scope decisions, evidence habits, and internal effort that set what a SOC 2 audit costs, and which of them you can change before you sign anything.
6 min read
Compliance frameworks
Preparing for a CMMC assessment
A practical order of work for CMMC assessment prep: fix scope, assemble what the assessor reads first, build evidence per objective, and rehearse the room.
6 min read
Compliance frameworks
ISO 27001 for startups: a realistic first certification
What a small team needs for a first ISO 27001 certificate: a defensible scope, a working ISMS, the records auditors check, and the order to build it.
6 min read
Audit readiness
Proving population completeness to an auditor
Before an auditor samples, they test the list you sample from. How completeness and accuracy testing works, and how to get a population accepted first time.
6 min read
Compliance frameworks
How to choose a SOC 2 audit firm
The checks that matter when picking a SOC 2 auditor: licensing, peer review, independence, who does the fieldwork, and what a proposal should commit to.
6 min read
Compliance frameworks
21 CFR Part 11 explained
What FDA's Part 11 covers, how predicate rules decide whether it applies to your records, and which controls the FDA's 2003 scope guidance still enforces.
7 min read
Compliance frameworks
NIS2 essential vs important entities
How NIS2 decides whether you are in scope, how it sorts entities into essential and important, and what the label changes for supervision and enforcement.
6 min read
Compliance frameworks
SOX IT general controls, explained
What SOX IT general controls are, why financial auditors test them, the four areas they cover, how systems get scoped in, and how they differ from SOC 2.
6 min read
Compliance frameworks
CMMC Level 2: self-assessment vs C3PAO assessment
Who decides which CMMC Level 2 assessment you face, what stays identical between a self-assessment and a C3PAO assessment, and where the two diverge.
6 min read
Compliance frameworks
The PCI DSS customized approach
The customized approach lets you meet a PCI DSS objective with your own control. What you must document, how assessors test it, and when it is worth it.
6 min read
Compliance frameworks
What a SOC 2 readiness assessment should cover
The eight areas a SOC 2 readiness assessment should cover, the outputs you should expect from it, and how to tell a useful assessment from a checklist.
6 min read