Compliance

How to build a data retention policy: set a schedule, meet GDPR, PCI DSS and HIPAA rules, handle legal holds, backups and logs, and prove deletion.

How to answer vendor security questionnaires faster: use standard formats, build an answer library, share SOC 2 and ISO reports, and answer precisely.

Is HITRUST certification worth the effort? Compare the e1, i1 and r2 assessments, see what drives the work, and learn when SOC 2 or ISO 27001 is enough.

How to write security policies auditors will accept: structure, ownership, review cycles, control mapping, acknowledgment evidence and an exceptions process.

PCI DSS vs. SOC 2 vs. ISO 27001: who requires each, what you get, how they overlap, and which order to pursue them in based on your customers and your data.

FedRAMP 20x aims to replace narrative paperwork with automated validation and faster authorizations. Here's what cloud providers know so far and what to do now.

U.S. state privacy laws now cover about 19 states. See 2025–2026 effective dates, how the laws differ, and how to build one program to the strictest rules.

HHS proposed the biggest HIPAA Security Rule update in over a decade: mandatory encryption, MFA, asset inventories and annual audits. Comments close March 7.

The EU Cyber Resilience Act sets security rules for products with digital elements. Key dates, product classes, Annex I requirements, SBOMs and reporting.

DORA applies from January 17, 2025. Learn its five pillars, the oversight of critical ICT providers, which RTS and ITS are final, and a readiness checklist.

The CMMC 2.0 final rule takes effect December 16, 2024. Learn the three levels, assessment types, POA&M limits, annual affirmations and the phased rollout.

Continuous compliance replaces the annual audit scramble with automated evidence collection, continuous control monitoring and policy-as-code. Here's how.

The EU AI Act entered into force on August 1, 2024. What security teams need to know: risk tiers, Article 15 cybersecurity, logging, deadlines and fines.

The NIS2 Directive covers medium and large firms in 18 sectors. Learn who is in scope, essential vs. important entities, Article 21 measures and fines.

CISA's proposed CIRCIA rule would have critical infrastructure entities report substantial cyber incidents within 72 hours. Who's covered and what to expect.

The ISO 27001:2022 transition deadline is October 31, 2025. See what changed in the clauses and Annex A, and how to plan a smooth move off the 2013 version.

NIST CSF 2.0 adds a sixth function, Govern. Learn what the Govern function covers, why NIST added it, and how smaller teams can put it into practice.

The NYDFS Part 500 amendments phase in new cybersecurity requirements through November 2025. Here are the key deadlines, Class A rules and what's due next.

The amended FTC Safeguards Rule requires non-bank financial institutions to report breaches affecting 500 or more consumers within 30 days, from May 13, 2024.

The SEC cybersecurity disclosure rules require an 8-K within four business days of finding an incident material, plus new 10-K disclosures. Key dates inside.

Control mapping lets one control set satisfy SOC 2, ISO 27001, PCI DSS and NIST CSF. How to build a common control framework, reuse evidence and avoid gaps.

The cyber insurance requirements underwriters now expect, from MFA and EDR to tested backups and patching, and how to answer applications accurately.

How the GDPR 72-hour breach notification rule works in practice: when the clock starts, what to report, when to tell individuals, and a workable response plan.

SOC 2 Type I vs. Type II explained: what each report tests, how long it takes, when a Type I is enough, and how to pick the right report for your customers.

Compliance vs. security: why passing a SOC 2, ISO 27001 or PCI DSS audit doesn't mean you're secure, and how to treat compliance as a floor, not a ceiling.

NIST SP 800-53 Rev. 5 brings outcome-based controls, integrated privacy, a new supply chain family and separate baselines. See what changed and what to do next.

California voters approved the CPRA (Prop 24). See what changes from the CCPA, the 2022 and 2023 dates, and the new security, audit and breach liability rules.

The DFARS interim rule takes effect November 30, 2020. Learn how SPRS scores work, how to calculate your NIST 800-171 score and how the SSP and POA&M affect it.

PCI compliance doesn't pause when staff work from home. See which PCI DSS 3.2.1 requirements apply to remote workers and how to keep card data off home devices.

Schrems II struck down the EU-US Privacy Shield. Learn what the ruling means for SCCs and the data transfer steps your security team should take right now.

A step-by-step guide to the HIPAA security risk analysis: scope all ePHI, find threats and vulnerabilities, rate each risk, document it and act on the results.

SOC 2 readiness for your first audit: scope the system, pick Trust Services Criteria, run a gap assessment, gather evidence and plan the Type II window.

How to prepare for your NYDFS Part 500 annual certification: who signs, what records to keep, and a checklist of controls to verify before February 15.

CMMC 1.0 was released January 31, 2020. What defense contractors need to know: the five levels, third-party certification, FCI vs. CUI and how to prepare now.

The CCPA took effect January 1, 2020. What security teams must do now: map personal data, verify consumer requests and meet the law's reasonable security duty.