Blog
Compliance engineering, page 5
What auditors actually ask for, how evidence collection works in practice, and where the frameworks overlap. Written by people who have been through it.
Compliance frameworks
ASV scans: what passes and what fails
PCI DSS requires a passing external scan from an Approved Scanning Vendor every quarter. How scope is set, what fails a scan, and how to dispute a finding.
6 min read
Trust and sales
Sharing penetration test results with buyers
What buyers want from your penetration test, what a summary letter should contain, how to discuss open findings honestly, and when to share more detail.
6 min read
Compliance frameworks
The NIST 800-171 System Security Plan
What a NIST 800-171 system security plan must describe, a structure that works for assessors, and how to keep the plan accurate after the assessment.
6 min read
Compliance frameworks
What a SOC 2 bridge letter is and when buyers ask for one
What a SOC 2 bridge letter covers, who signs it, why it carries no auditor assurance, when buyers ask for one, and how to keep the gaps it covers short.
6 min read
Security engineering
Security monitoring and alerting
Logs prove nothing until someone looks. Which detections to build first, how to route and triage alerts, tune without losing coverage, and evidence it all.
6 min read
Audit readiness
Working well with your auditor
What your SOC 2 auditor or ISO certification body can and cannot help with, what to agree at kickoff, how to disagree with a finding, and what to ask after.
6 min read
Compliance frameworks
The FERPA school official exception
The three conditions a vendor must meet to receive student data as a FERPA school official, what direct control means for SaaS, and the redisclosure rules.
6 min read
Privacy
Do you need a data protection officer?
The three Article 37 tests for a mandatory DPO, what core activities and large scale mean, who can hold the role, and how to record a decision not to appoint.
7 min read
Compliance frameworks
PHI vs ePHI: what counts as protected health information
How HIPAA defines PHI and ePHI, why the holder matters as much as the data, what the definitions exclude, and how to classify the edge cases SaaS teams hit.
6 min read
Compliance frameworks
Running the ISO 27001 internal audit
What ISO 27001 clause 9.2 requires of an internal audit, who can perform it, how to build the audit program, and how to run one audit from plan to report.
6 min read
Risk and vendors
Fourth-party risk, explained
What fourth-party risk is, where your vendors' vendors show up in SOC 2 reports and sub-processor lists, what GDPR and ISO 27001 expect, and what to do.
6 min read
AI governance
AI vendor risk: questions to ask before you adopt a model
The questions to add to vendor due diligence before adopting an AI model or AI feature: data use, retention, hosting, model changes, incidents, contracts.
6 min read
Compliance frameworks
Carve-out vs inclusive: subservice organizations in SOC 2
How the carve-out and inclusive methods treat subservice organizations in a SOC 2, when each one fits, and the monitoring controls a carve-out requires.
6 min read
Compliance frameworks
NIST 800-171 Revision 2 vs Revision 3
What changed between NIST SP 800-171 Rev. 2 and Rev. 3, which revision your contract likely requires, and how to prepare for Rev. 3 without wasted work.
6 min read
Security engineering
Centralized logging for compliance
What to log, what each event must contain, how long to keep it, and how to protect it. Centralized logging mapped to SOC 2, ISO 27001, PCI DSS and HIPAA.
5 min read
Audit readiness
What to do when a control fails mid-period
A control failed partway through your SOC 2 or ISO 27001 audit period. How to contain it, measure the extent, find the cause, and tell your auditor.
6 min read
Trust and sales
Answering due diligence questionnaires
What a vendor due diligence questionnaire asks beyond security, who should own each section, and how to handle financials, continuity and signed attestations.
6 min read
Security engineering
Access reviews that hold up under audit
Most access reviews fail on evidence, not on rigor. Here is what an auditor samples, and the four artifacts that make a review defensible months later.
3 min read
Privacy
GDPR breach notification and the 72-hour clock
When the GDPR's 72-hour breach clock starts, what an Article 33 notice must contain, when to tell individuals, and how processors fit into the timeline.
7 min read
Compliance frameworks
DORA resilience testing and TLPT
What DORA's testing program requires every year, which entities must run threat-led penetration tests, who may test, and what ICT providers must do.
6 min read
Compliance frameworks
HITRUST vs SOC 2 for healthcare buyers
How a HITRUST certification and a SOC 2 report differ in who issues them, what they test and how long they last, and how to tell which your buyer needs.
6 min read
Compliance frameworks
Building NIST CSF current and target profiles
How to build NIST CSF 2.0 current and target profiles: scoping, describing current practice with evidence, setting targets by risk, and planning gaps.
6 min read
Compliance frameworks
Network segmentation for PCI DSS
Segmentation is not a PCI DSS requirement, but without it your whole network is in scope. What counts as isolation, how to test it, and where it usually fails.
6 min read
Compliance frameworks
ISO 27001 surveillance audits: what to expect each year
What an ISO 27001 surveillance audit must cover, how the certification body samples across the three-year cycle, and how to run the year between audits.
6 min read