Tag
Evidence, page 3
59 articles
Compliance frameworks
The SOC 2 confidentiality criterion in practice
What C1.1 and C1.2 ask in practice: defining confidential data, finding every copy, deleting it on time at contract end, and the records an auditor samples.
6 min read
Audit readiness
How auditors sample controls
How SOC 2 auditors set sample sizes, select items from your population and handle a failed sample, and how ISO 27001 certification audits sample instead.
6 min read
Compliance frameworks
Preparing for a HITRUST validated assessment
The steps before HITRUST fieldwork: fixing scope, choosing an assessor, running a readiness assessment, building evidence, and what happens at QA.
6 min read
Trust and sales
Building a security answer library
How to structure a security answer library: the fields each entry needs, how to seed it from past questionnaires, and the review rules that keep it true.
6 min read
Compliance frameworks
ISO 27701 controller and processor controls
How to decide which ISO 27701 role you hold per activity, what the controller and processor control sets ask for, and the evidence each one has to produce.
6 min read
Compliance frameworks
HIPAA administrative safeguards in practice
How to run each HIPAA administrative safeguard as a working process: who owns it, what it produces, and the dated records that show it operated all year.
6 min read
Privacy
How to build an Article 30 record of processing
The fields GDPR Article 30 requires of controllers and processors, how to structure the record by purpose, and the habits that keep it accurate.
6 min read
Audit readiness
Types of audit evidence, and which is strongest
Inquiry, observation, inspection and reperformance, ranked the way auditing standards rank them, and what that ranking means for the records you keep.
6 min read
Compliance frameworks
What the SOC 2 security criterion actually requires
The SOC 2 security category is nine series of common criteria, CC1 to CC9. What each one asks, what evidence auditors test, and what the criteria leave to you.
7 min read
Security engineering
SSO as a compliance control
Single sign-on makes access controls cheaper to run and easier to prove, but only for the apps behind it. What SSO covers, what it misses, and what to test.
6 min read
Security engineering
Enforcing MFA for every user
Turning MFA on is easy. Proving it covers every account is not. Where coverage breaks, which factors hold up, and the MFA evidence auditors actually test.
7 min read