TrustLynce Editorial Team, page 6
Compliance and security writers
The TrustLynce team writes about SOC 2, ISO 27001, HIPAA, GDPR and the work underneath them: scoping, evidence, controls, audits and security reviews. Guidance here is general information, not legal or audit advice.
213 articles
Compliance frameworks
FERPA for EdTech vendors
FERPA regulates schools, not vendors, yet it shapes every EdTech contract. How it reaches you, what counts as an education record, and the controls to run.
6 min read
Compliance frameworks
HIPAA breach notification: timelines and thresholds
When an incident is a HIPAA breach, when the 60-day clock starts, who must be told at the 500-person thresholds, and what business associates owe customers.
6 min read
Compliance frameworks
Complementary user entity controls, explained
What complementary user entity controls are, why SOC 2 reports list them, how to write ones auditors and buyers accept, and what to do with a vendor's list.
6 min read
Security engineering
MDM vs a lightweight endpoint agent
MDM enforces device settings; a lightweight agent reports them. What auditors need from endpoints, when each approach fits, and how to combine the two.
6 min read
Compliance frameworks
Scoping where CUI lives in your environment
How to trace where CUI enters and moves, sort assets into the CMMC scoping categories, choose between an enclave and the enterprise, and document the result.
6 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Audit readiness
Fixing gaps before the observation period starts
How to sort readiness gaps by type, decide which must close before a SOC 2 Type II period starts, prove each fix works, and pick a start date you can hold.
6 min read
AI governance
Writing an AI acceptable use policy
How to write an AI acceptable use policy staff will follow: scope, approved tools, data rules by classification, output review, prohibited uses, upkeep.
6 min read
Privacy
Handling data subject access requests on time
How to answer a GDPR access request within one month: the deadline rules, proportionate identity checks, what the response must contain, and the records.
6 min read
Security engineering
Full-disk encryption on every laptop
A lost laptop is a non-event if you can prove it was encrypted. What the rules say, why recovery keys matter, and how to evidence encryption on every device.
5 min read
Compliance frameworks
Writing the SOC 2 system description
What the SOC 2 system description must contain under the AICPA's DC 200 criteria, how auditors test it, and how to write one that stays accurate.
6 min read
Compliance frameworks
ISO 27001 stage 1 vs stage 2 audits
What the certification body examines in an ISO 27001 stage 1 and stage 2 audit, how the two stages differ, what happens between them, and how to prepare.
6 min read
Trust and sales
Handling an enterprise security review
A stage-by-stage playbook for an enterprise security review: intake questions, the standard package, the questionnaire, follow-up calls, and findings.
6 min read
Compliance frameworks
NIST 800-171: protecting CUI in practice
What NIST SP 800-171 requires of contractors holding CUI, the requirements that take the most work, and the DFARS obligations that sit alongside them.
6 min read
Compliance frameworks
Why the same control appears in four frameworks
SOC 2, ISO 27001, HIPAA and PCI DSS ask overlapping questions in different words. Mapping once and reusing the evidence is what makes the second one fast.
3 min read
Audit readiness
First-audit mistakes, and how to avoid them
The mistakes that make a first SOC 2 or ISO 27001 audit slower and messier: aspirational policies, unknown populations, ignored vendors and the draft report.
6 min read
Compliance frameworks
What an ISO 27701 certification audit involves
How an ISO 27701 certification audit runs: choosing a certification body, stage 1 and stage 2, what gets sampled, nonconformities, and surveillance.
6 min read
Compliance frameworks
The HIPAA risk analysis requirement
What the HIPAA Security Rule's risk analysis must cover, the elements HHS guidance expects, how to scope all ePHI, and what is often mistaken for one.
6 min read
Compliance frameworks
DORA third-party risk and the register of information
How DORA's Articles 28 and 29 govern ICT third-party risk, what the register of information must hold, and how to assess, monitor and exit ICT providers.
6 min read
Compliance frameworks
HITRUST inheritance from cloud providers
How HITRUST inheritance works, what you can and cannot inherit from a cloud provider, full versus shared requirements, and the mistakes that cost scores.
6 min read
Compliance frameworks
Tokenization and PCI DSS scope
Tokenization takes systems out of PCI DSS scope only under certain conditions. Where the vault sits, who can detokenize, and what assessors check in a design.
6 min read
Security engineering
Patch management evidence
"Show us systems are patched" is a hard request when assets differ. The evidence that holds up for laptops, servers, containers and managed services, over time.
6 min read
Risk and vendors
Vendor tiering by data access
How to tier vendors by the data and systems they can reach, the intake questions that set a tier, what each tier triggers, and edge cases that mislead.
6 min read
Privacy
Transfer impact assessments after Schrems II
What a transfer impact assessment must show after Schrems II, the EDPB's six steps, how the Data Privacy Framework changes US transfers, and what to record.
6 min read