Tag
Evidence, page 2
59 articles
Security engineering
Running a tabletop exercise
A tabletop exercise is how most teams test an incident response plan. How to set objectives, write injects, run the session, and produce a report that counts.
6 min read
Audit readiness
What auditors actually ask for
Fieldwork is mostly a request list. Knowing the shape of that list in advance turns a stressful three weeks into a week of sending things you already have.
3 min read
Compliance frameworks
The HITRUST r2 interim assessment
What the HITRUST r2 interim assessment covers, when it falls, what your assessor tests, and how to keep year one of your certification from slipping.
6 min read
Compliance frameworks
ASV scans: what passes and what fails
PCI DSS requires a passing external scan from an Approved Scanning Vendor every quarter. How scope is set, what fails a scan, and how to dispute a finding.
6 min read
Security engineering
Security monitoring and alerting
Logs prove nothing until someone looks. Which detections to build first, how to route and triage alerts, tune without losing coverage, and evidence it all.
6 min read
Compliance frameworks
Running the ISO 27001 internal audit
What ISO 27001 clause 9.2 requires of an internal audit, who can perform it, how to build the audit program, and how to run one audit from plan to report.
6 min read
Security engineering
Centralized logging for compliance
What to log, what each event must contain, how long to keep it, and how to protect it. Centralized logging mapped to SOC 2, ISO 27001, PCI DSS and HIPAA.
5 min read
Security engineering
Access reviews that hold up under audit
Most access reviews fail on evidence, not on rigor. Here is what an auditor samples, and the four artifacts that make a review defensible months later.
3 min read
Compliance frameworks
ISO 27001 surveillance audits: what to expect each year
What an ISO 27001 surveillance audit must cover, how the certification body samples across the three-year cycle, and how to run the year between audits.
6 min read
Security engineering
MDM vs a lightweight endpoint agent
MDM enforces device settings; a lightweight agent reports them. What auditors need from endpoints, when each approach fits, and how to combine the two.
6 min read
Security engineering
Full-disk encryption on every laptop
A lost laptop is a non-event if you can prove it was encrypted. What the rules say, why recovery keys matter, and how to evidence encryption on every device.
5 min read
Compliance frameworks
Writing the SOC 2 system description
What the SOC 2 system description must contain under the AICPA's DC 200 criteria, how auditors test it, and how to write one that stays accurate.
6 min read
Compliance frameworks
ISO 27001 stage 1 vs stage 2 audits
What the certification body examines in an ISO 27001 stage 1 and stage 2 audit, how the two stages differ, what happens between them, and how to prepare.
6 min read
Compliance frameworks
What an ISO 27701 certification audit involves
How an ISO 27701 certification audit runs: choosing a certification body, stage 1 and stage 2, what gets sampled, nonconformities, and surveillance.
6 min read
Security engineering
Patch management evidence
"Show us systems are patched" is a hard request when assets differ. The evidence that holds up for laptops, servers, containers and managed services, over time.
6 min read
Audit readiness
The PBC list: handling auditor requests
How to run an audit request list: triage, a tracker with the right fields, file naming, quality checks before you send, and keeping sensitive data out.
6 min read
Security engineering
Vulnerability management SLAs auditors accept
Auditors test whether you met your own remediation windows. How to set severity tiers and SLAs you can keep, handle exceptions, and evidence every finding.
6 min read
Compliance frameworks
Writing control implementation statements
How to write NIST 800-53 implementation statements an assessor can test: cover every part and parameter, name the mechanism, and handle inherited controls.
6 min read
Security engineering
Joiner, mover, leaver processes
Joiner, mover, leaver is one access process with three triggers. How to run each event from the HR record, why movers get missed, and what evidence to keep.
6 min read
Compliance frameworks
HITRUST maturity scoring in the r2 assessment
How the r2 scores each requirement across policy, procedure, implemented, measured and managed, what evidence moves a score, and where effort pays off.
6 min read
AI governance
ISO 42001 Annex A controls explained
The nine ISO/IEC 42001 Annex A control areas: what each covers, the evidence an auditor samples, which ones are new work, and how to justify an exclusion.
6 min read
Security engineering
Offboarding that removes access the same day
Late access removal is a classic audit exception. How to set a testable standard, start from a trigger you trust, and remove access in the right order.
6 min read
Compliance frameworks
SOC 2 Type I vs Type II: what actually differs
Type I reports on design at a point in time. Type II reports on operation over a window. That single difference changes scoping, evidence and your timeline.
3 min read
Audit readiness
What happens in an audit walkthrough
What an auditor does in a control walkthrough, what they are testing, what to have open on screen, and the mistakes that turn a one-hour session into three.
6 min read