Tag
Audit Readiness, page 4
82 articles
Compliance frameworks
ISO 27001 clause 4: context and interested parties
What ISO 27001 clauses 4.1 to 4.4 require, how to record your issues and interested parties so they drive scope and risk, and what auditors look for.
6 min read
Audit readiness
Types of audit evidence, and which is strongest
Inquiry, observation, inspection and reperformance, ranked the way auditing standards rank them, and what that ranking means for the records you keep.
6 min read
Compliance frameworks
What the SOC 2 security criterion actually requires
The SOC 2 security category is nine series of common criteria, CC1 to CC9. What each one asks, what evidence auditors test, and what the criteria leave to you.
7 min read
Risk and vendors
Building a risk register auditors accept
The fields a risk register needs, how to write risks that are not missing controls in disguise, and the register mistakes auditors turn into findings.
7 min read
Audit readiness
Planning your first audit timeline
Plan a first SOC 2 or ISO 27001 audit backward from the date it is needed: the steps that cannot be compressed, what each waits on, and where plans slip.
6 min read
Compliance frameworks
HITRUST e1, i1 and r2 compared
What the HITRUST e1, i1 and r2 assessments each test, how they are scored, how long each certification lasts, and how to pick the one your buyers accept.
6 min read
AI governance
What ISO 42001 certifies
ISO/IEC 42001 certifies an AI management system, not a model. What the certificate attests, what it leaves out, and how to read one a vendor sends.
6 min read
Compliance frameworks
What changed in PCI DSS 4.0
PCI DSS 4.0 added a customized approach, targeted risk analysis and new requirements for MFA and payment pages. What changed, and what 4.0.1 clarified.
6 min read
Compliance frameworks
What an ISMS is, in plain terms
An ISMS is the management system ISO 27001 certifies, not a tool or a binder. What it is made of, what clauses 4 to 10 require, and where Annex A fits.
6 min read
Compliance frameworks
The SOC 2 trust services criteria, explained one by one
What each of the five SOC 2 trust services categories covers, which one is required, how the criteria are numbered, and how to decide what is in scope.
7 min read