Tag
Evidence
59 articles
Compliance frameworks
The policies a SOC 2 audit expects to see
The criteria never list required policies, yet auditors expect a familiar set. Which policies to write, what each must say, and how auditors test them.
6 min read
Compliance frameworks
SOX change management controls
How SOX auditors test program change: the change population, testing and approval, developer access to production, emergency changes and config changes.
6 min read
Compliance frameworks
PCI DSS requirement 10: logging and log review
What PCI DSS Requirement 10 says to log, the fields every entry needs, which logs need daily review, how long to keep them, and what assessors ask to see.
6 min read
Compliance frameworks
Corrective actions that close ISO 27001 findings
How to answer an ISO 27001 nonconformity so it closes: correction versus corrective action, a cause analysis that holds, and proof the fix worked.
6 min read
Audit readiness
Running a mock audit
A mock audit tests whether you can produce evidence under audit conditions. Who should play the auditor, what to scope, how to run it, and how to use findings.
6 min read
Compliance frameworks
Computer system validation for SaaS
Who validates a SaaS system under FDA rules, which documents each side owns, and how to keep validation current when the vendor ships changes every month.
6 min read
Compliance frameworks
HIPAA workforce training that counts as evidence
The two HIPAA training requirements, who counts as workforce, the records an investigator or customer asks for, and how to prove that no one was missed.
6 min read
Audit readiness
An audit readiness checklist
A working checklist for the weeks before an audit: scope, documents, owners, populations, people, vendors and logistics, with what each item must show.
6 min read
Compliance frameworks
Access to programs and data for SOX
The SOX ITGC access controls auditors test: provisioning, removal, access reviews, privileged access and segregation of duties, with the evidence each needs.
6 min read
Compliance frameworks
Mapping NIST CSF to ISO 27001
How NIST CSF 2.0 functions map to ISO 27001:2022 clauses and Annex A controls, where the mapping breaks down, and how one evidence set serves both.
6 min read
AI governance
Human approval for AI-drafted compliance work
How to approve AI-drafted policies, questionnaire answers, and control text so the approval means something: what to check, what to record, what not to draft.
6 min read
Compliance frameworks
What drives the cost of a SOC 2 audit
The scope decisions, evidence habits, and internal effort that set what a SOC 2 audit costs, and which of them you can change before you sign anything.
6 min read
Privacy
Building a data retention schedule
How to build a data retention schedule that works: the fields each entry needs, choosing trigger events, handling backups and legal holds, and proving deletion.
6 min read
Compliance frameworks
Preparing for a CMMC assessment
A practical order of work for CMMC assessment prep: fix scope, assemble what the assessor reads first, build evidence per objective, and rehearse the room.
6 min read
Audit readiness
Proving population completeness to an auditor
Before an auditor samples, they test the list you sample from. How completeness and accuracy testing works, and how to get a population accepted first time.
6 min read
Security engineering
Branch protection rules auditors look for
The branch protection settings that make code review a testable control, the bypass paths auditors probe, and the evidence that proves it held all period.
7 min read
Compliance frameworks
HIPAA audit logs: what to record and keep
What the Security Rule requires of audit controls, which events to log in systems holding ePHI, how to review them, and what it leaves to you on retention.
6 min read
Security engineering
Code review as a change management control
For most software teams, the pull request review is the change approval. What it must establish, which changes it must cover, and how auditors sample it.
6 min read
Compliance frameworks
What a SOC 2 readiness assessment should cover
The eight areas a SOC 2 readiness assessment should cover, the outputs you should expect from it, and how to tell a useful assessment from a checklist.
6 min read
Audit readiness
Screenshots vs system-generated evidence
When a screenshot is acceptable audit evidence, what it must show, why exports and system reports usually serve better, and how auditors test the reports.
6 min read
Compliance frameworks
Choosing your SOC 2 Type II observation period
How to choose the length and dates of a SOC 2 Type II observation period: what each length allows, how control frequency limits it, and where to put the end.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Security engineering
Backup and restore testing
A backup is only a control once you have restored from it. What to back up, how to keep backups out of an incident's reach, and how to run and record restores.
6 min read
Compliance frameworks
SOC 2 exceptions and qualified opinions: what they mean
What a SOC 2 exception is, how auditors decide whether it changes the opinion, the four opinion types, and how to respond when your own report has findings.
6 min read