Tag
Policies
20 articles
Compliance frameworks
The policies a SOC 2 audit expects to see
The criteria never list required policies, yet auditors expect a familiar set. Which policies to write, what each must say, and how auditors test them.
6 min read
Compliance frameworks
HIPAA workforce training that counts as evidence
The two HIPAA training requirements, who counts as workforce, the records an investigator or customer asks for, and how to prove that no one was missed.
6 min read
Compliance frameworks
NIS2 cybersecurity risk management measures
The ten cybersecurity risk management measures in NIS2 Article 21, what each one asks for in practice, the evidence to keep, and how ISO 27001 maps to them.
6 min read
AI governance
Human approval for AI-drafted compliance work
How to approve AI-drafted policies, questionnaire answers, and control text so the approval means something: what to check, what to record, what not to draft.
6 min read
Compliance frameworks
ISO 27001 vs ISO 27002: what each document does
ISO 27001 sets the requirements you are certified against. ISO 27002 explains how to implement each control. How the two fit, and when to reach for each.
6 min read
Compliance frameworks
Addressable vs required: HIPAA encryption explained
What addressable means in the HIPAA Security Rule, where encryption sits in it, how it links to breach notification, and how to document each decision.
6 min read
Privacy
Building a data retention schedule
How to build a data retention schedule that works: the fields each entry needs, choosing trigger events, handling backups and legal holds, and proving deletion.
6 min read
Security engineering
Business continuity and disaster recovery plans
Continuity keeps the business running; recovery restores the technology. How to run an impact analysis, map dependencies, write both plans, and test them.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
AI governance
Writing an AI acceptable use policy
How to write an AI acceptable use policy staff will follow: scope, approved tools, data rules by classification, output review, prohibited uses, upkeep.
6 min read
Compliance frameworks
Moving from ISO 27001:2013 to the 2022 edition
The ISO 27001:2013 transition period is over. What changed in the clauses and Annex A, where 2013 leftovers hide in an ISMS, and how to check for them.
6 min read
Compliance frameworks
How to write a Statement of Applicability
What ISO 27001 requires in a Statement of Applicability, the columns worth adding, how to justify inclusions and exclusions, and how to keep it current.
6 min read
Compliance frameworks
HITRUST maturity scoring in the r2 assessment
How the r2 scores each requirement across policy, procedure, implemented, measured and managed, what evidence moves a score, and where effort pays off.
6 min read
Compliance frameworks
What the Govern function added in NIST CSF 2.0
Which parts of the NIST CSF 2.0 Govern function moved from version 1.1, which are new, and what each of the six Govern categories asks you to produce.
6 min read
Compliance frameworks
The ISO 27001:2022 Annex A themes, explained
How the 93 Annex A controls in ISO 27001:2022 are grouped into four themes, which 11 controls are new, and how ISO 27002 attributes let you sort them.
5 min read
Compliance frameworks
The SOC 2 confidentiality criterion in practice
What C1.1 and C1.2 ask in practice: defining confidential data, finding every copy, deleting it on time at contract end, and the records an auditor samples.
6 min read
AI governance
Building an AI management system
A practical build order for an ISO/IEC 42001 AI management system: scope, policy, risk and impact methods, controls, and the first full audit cycle.
6 min read
Trust and sales
Building a security answer library
How to structure a security answer library: the fields each entry needs, how to seed it from past questionnaires, and the review rules that keep it true.
6 min read
Compliance frameworks
HIPAA administrative safeguards in practice
How to run each HIPAA administrative safeguard as a working process: who owns it, what it produces, and the dated records that show it operated all year.
6 min read
Compliance frameworks
The HIPAA Security Rule's three safeguard types
What the HIPAA Security Rule's administrative, physical and technical safeguards each cover, how addressable specs work, and where the work starts.
7 min read