Compliance and Regulation

SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and the breach notification laws, in plain language and with the deadlines that matter.

31 resources

Start here

Cyber Security Compliance: Frameworks and Deadlines

Compliance work usually starts with an email nobody in the company can classify: a customer asking for a report, or a regulator pointing at a rule. Which of the two you are holding decides everything that happens next.

21 min read

Intermediate

Audit vs Assessment vs Certification: Key Differences

Three words arrive in the same procurement thread and get used as though they were one. They describe different work, done by different people, ending in documents with different shelf lives.

17 min read

Intermediate

Data Breach Notification Laws by State and Deadlines

Fifty states wrote fifty answers to the same question, and a company holding customer records in a dozen of them is holding a dozen deadlines at once. The hard part is not the number of days. It is knowing which day the counting started.

20 min read

Intermediate

How Long a SOC 2 Audit Takes: The Timeline by Phase

The date procurement wants and the date a report can exist are set by two different things. One is a quarter end. The other is an observation period that has to actually elapse.

15 min read

Intermediate

How to Answer a Security Questionnaire, Step by Step

A security questionnaire is not a form. It is a set of representations your buyer can check, your lawyers will inherit, and your next customer will compare against the last set you sent.

21 min read

Intermediate

How to Prepare for a SOC 2 Audit: The 9 Steps in Order

The order of the work decides whether your first report comes back clean. A control switched on halfway through the observation period produces evidence for half of it and a finding for the rest.

19 min read

Intermediate

How to Read a SOC 2 Report: A Section by Section Guide

A vendor answers your security questionnaire by attaching a ninety page PDF, and procurement wants a yes or a no by Friday. The useful parts of that document are in four places, and a first pass takes about half an hour once you know where to look.

19 min read

Intermediate

ISO 27001 vs SOC 2: Which One Does Your Business Need?

One standard certifies that you run a management system. The other reports an accountant's opinion on your controls. Companies pick the wrong one because they compare the security requirements, when the answer is decided by who is asking.

17 min read

Intermediate

NIST Cybersecurity Framework: Functions, Tiers and Profiles

The framework arrives attached to an insurance form or a customer questionnaire, and the question behind it is always the same: are we obliged to do this? The answer is written into the statute that created it, and almost nobody quotes that statute.

16 min read

Intermediate

NYDFS Part 500 Explained: Rules, Deadlines, Penalties

Part 500 is not a framework you adopt because a customer asked. It is a New York regulation, it attaches to your license rather than your address, and it names the officer who has to sign for it.

19 min read

Intermediate

PCI DSS Compliance: 12 Requirements, Levels and SAQs

PCI DSS is twelve requirements written in plain language, wrapped in machinery that almost nobody explains: four merchant levels, ten questionnaires named after letters and acronyms, and an enforcement chain that runs through your bank rather than through Visa.

22 min read

Intermediate

SOC 1 vs SOC 2 vs SOC 3: Which Report Do You Need?

The numbers are labels, not levels. A SOC 1 is not a starter SOC 2 and a SOC 3 is not the advanced one, and picking by the number is how companies spend a year producing a report their customer never asked for.

14 min read

Intermediate

SOC 2 Audit Cost: What the Published Numbers Say

Every page that answers this question gives you a range and no source. Here is what an actual audit firm publishes, what the compliance vendors publish, and how to tell those two things apart before you write the budget.

16 min read

Intermediate

SOC 2 Readiness Services: What They Cover and What to Ask

Readiness is the part of SOC 2 you actually shop for, and the proposals are impossible to compare because one prices a diagnosis and another prices the treatment. This is what you are buying, from who, and on what terms.

24 min read

Intermediate

SOC 2 Trust Services Criteria: The Five Categories

Every SOC 2 report names the categories it was examined against, and that one line decides what the report cost and how much a buyer should read into it. The five categories are not a menu of equal options.

14 min read

Intermediate

SOC 2 Type 1 vs Type 2: Which Report Do You Need?

Both reports come from the same auditor, cover the same criteria and carry the same logo. One of them says your controls were designed properly on a Tuesday. The other says they ran every day for months, and that difference is the whole product.

17 min read

Intermediate

The FTC Safeguards Rule, Explained: Elements and Fines

A federal data security rule with named technical controls applies to tax preparers, auto dealers and mortgage brokers, and most of them find out from a customer questionnaire rather than from the FTC.

16 min read

Intermediate

The HIPAA Security Rule, Explained: Safeguards and Fines

The Security Rule is the only federal cyber security regulation that names its safeguards in statutory text. It is also the one people most often describe from memory, wrongly, right up until the Office for Civil Rights asks to see the paperwork.

24 min read

Intermediate

The SEC Cyber Disclosure Rules: Item 1.05 and Item 106

The four business day deadline everyone quotes does not run from the day you were breached. It runs from a judgment call your own company makes, which is why the rule is harder to comply with than it is to summarize.

16 min read

Intermediate

Vendor Risk Management, Explained: Rules and Process

Nearly half of breaches now arrive through somebody else's company. Vendor risk management is the program that decides which of those companies you let near your data, and four separate US regimes tell you, in numbered paragraphs, what that program has to contain.

21 min read

Intermediate

What Compliance Automation Platforms Do (and Do Not)

A compliance automation platform turns a quarterly scramble for screenshots into a dashboard that is always on. It also creates a new dependency, and it cannot sign the thing a regulator asks a named person to sign.

19 min read

Intermediate

What Is a Security Audit? What One Actually Involves

An audit is not a scan, a questionnaire or a consultant's opinion. It is an independent examination against criteria fixed before anyone arrives, and knowing that changes what you buy and what you can hand a customer.

16 min read

Intermediate

What Is a SOC 2 Bridge Letter, and When You Need One

A bridge letter is the document that covers the months your SOC 2 report does not. It is written by your own management, signed by nobody independent, and worth exactly as much as the sentence in it that says nothing material changed.

16 min read

Intermediate

What Is CMMC? The Levels, Requirements and Deadlines

A CMMC level arrives in a solicitation or a flow-down clause with the number already chosen for you. The work is figuring out which one you were handed, what the rule requires at that level, and how long you have.

20 min read

Intermediate

What Is FedRAMP? Impact Levels, Costs and 20x Rules

An agency buyer says the purchase cannot happen without FedRAMP, and most of what is published about the program describes rules that were replaced in June 2026.

19 min read

Intermediate

What Is GDPR and When Does It Apply to US Companies?

A US company can fall under GDPR without ever opening an office in Europe, and the clause that does it is one sentence long. Most American businesses meet the rest of the regulation during an incident rather than before one.

21 min read

Intermediate

What Is HITRUST? Certification, Costs and Assessments

A health plan's vendor risk team asks for HITRUST certification and names a tier you have never heard of. The letters come from a private company, not a regulator, and that single fact explains most of what follows.

13 min read

Intermediate

What Is ISO 27001? Requirements and Certification

A customer asks whether you are certified to ISO 27001, and the honest answer turns on a distinction most vendors never make: the standard describes a management system, and the certificate is an optional purchase on top of it.

17 min read

Intermediate

What Is NIST SP 800-171? Requirements and Who It Binds

NIST SP 800-171 is a free public document that binds nobody on its own. A contract clause makes it binding, and the clause and the publication do not always point at the same version.

18 min read

Intermediate

What Is SOC 2 Compliance? Criteria, Types and Audits

SOC 2 is the report enterprise buyers ask for before they will hand you their data. It is an accountant's opinion on your controls, not a certificate, and understanding that difference is what tells you how much one is worth.

16 min read

Intermediate

What Is the CCPA? Requirements, Rights and Penalties

The CCPA does not care what industry you are in or whether you have an office in California. It cares about three numbers, and if you cross one of them the whole statute lands on you at once.

15 min read