Blog
Compliance engineering, page 2
What auditors actually ask for, how evidence collection works in practice, and where the frameworks overlap. Written by people who have been through it.
Risk and vendors
NIST 800-30 risk assessments
How to run a risk assessment with NIST SP 800-30 Rev. 1: the four steps, the risk model, how likelihood and impact combine, and what the report must hold.
6 min read
Compliance frameworks
CMMC for subcontractors in the defense supply chain
How CMMC reaches subcontractors through flow-down, why the level you need follows the information you receive, and what to settle with your prime first.
5 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Compliance frameworks
NIS2 cybersecurity risk management measures
The ten cybersecurity risk management measures in NIS2 Article 21, what each one asks for in practice, the evidence to keep, and how ISO 27001 maps to them.
6 min read
Compliance frameworks
Access to programs and data for SOX
The SOX ITGC access controls auditors test: provisioning, removal, access reviews, privileged access and segregation of duties, with the evidence each needs.
6 min read
Compliance frameworks
Mapping NIST CSF to ISO 27001
How NIST CSF 2.0 functions map to ISO 27001:2022 clauses and Annex A controls, where the mapping breaks down, and how one evidence set serves both.
6 min read
Compliance frameworks
PCI DSS requirement 8 and multi-factor authentication
PCI DSS 4.0 requires MFA for all access into the cardholder data environment. Which access paths need it, the exemptions, and how the MFA system must work.
6 min read
AI governance
Human approval for AI-drafted compliance work
How to approve AI-drafted policies, questionnaire answers, and control text so the approval means something: what to check, what to record, what not to draft.
6 min read
Compliance frameworks
ISO 27001 vs ISO 27002: what each document does
ISO 27001 sets the requirements you are certified against. ISO 27002 explains how to implement each control. How the two fit, and when to reach for each.
6 min read
Audit readiness
Assigning control owners who stay engaged
Naming a control owner takes a minute; keeping them engaged for an audit period is the real work. How to pick owners, define the role, and survive handovers.
6 min read
Compliance frameworks
Part 11 audit trails and electronic signatures
What 21 CFR 11.10(e), 11.50, 11.70 and Subpart C ask of audit trails and e-signatures, how they meet SSO and MFA, and the design errors that fail review.
7 min read
Compliance frameworks
Addressable vs required: HIPAA encryption explained
What addressable means in the HIPAA Security Rule, where encryption sits in it, how it links to breach notification, and how to document each decision.
6 min read
Compliance frameworks
What drives the cost of a SOC 2 audit
The scope decisions, evidence habits, and internal effort that set what a SOC 2 audit costs, and which of them you can change before you sign anything.
6 min read
Security engineering
Secrets management for engineering teams
Where application secrets should live, how to retire long-lived credentials, what to do in the first hour after a leak, and the evidence auditors ask for.
6 min read
Privacy
Building a data retention schedule
How to build a data retention schedule that works: the fields each entry needs, choosing trigger events, handling backups and legal holds, and proving deletion.
6 min read
Compliance frameworks
Preparing for a CMMC assessment
A practical order of work for CMMC assessment prep: fix scope, assemble what the assessor reads first, build evidence per objective, and rehearse the room.
6 min read
Trust and sales
Security commitments in customer contracts
Where security commitments hide in customer contracts, the types you will find, why your SOC 2 report depends on them, and how to keep a register that works.
6 min read
Risk and vendors
ISO 27005 risk management
What ISO/IEC 27005 is, how it supports ISO 27001 clause 6, and how to use its event-based and asset-based approaches to build a risk method you can defend.
6 min read
Compliance frameworks
ISO 27001 for startups: a realistic first certification
What a small team needs for a first ISO 27001 certificate: a defensible scope, a working ISMS, the records auditors check, and the order to build it.
6 min read
Audit readiness
Proving population completeness to an auditor
Before an auditor samples, they test the list you sample from. How completeness and accuracy testing works, and how to get a population accepted first time.
6 min read
Compliance frameworks
How to choose a SOC 2 audit firm
The checks that matter when picking a SOC 2 auditor: licensing, peer review, independence, who does the fieldwork, and what a proposal should commit to.
6 min read
Security engineering
Branch protection rules auditors look for
The branch protection settings that make code review a testable control, the bypass paths auditors probe, and the evidence that proves it held all period.
7 min read
Compliance frameworks
21 CFR Part 11 explained
What FDA's Part 11 covers, how predicate rules decide whether it applies to your records, and which controls the FDA's 2003 scope guidance still enforces.
7 min read
Compliance frameworks
NIS2 essential vs important entities
How NIS2 decides whether you are in scope, how it sorts entities into essential and important, and what the label changes for supervision and enforcement.
6 min read