Which Logs Prove Session Authenticity Maturity? (SC.L2-3.13.15)
Use session authenticity maturity evidence logs to score SC.L2-3.13.15 from ad hoc TLS proof to monitored, optimized mutual authentication.
Blog
Compliance guides, checklists, and news.
Practical, control-by-control guidance for CMMC, NIST SP 800-171, HIPAA, ISO 27001, and NCA ECC, written by the team that gets companies certified.
Latest articles
-
What Vendor Policies Should a Dental Office Review in Microsoft 365?
Use this Microsoft 365 vendor policy review checklist for dental offices to tier vendors, collect evidence, and document HIPAA due diligence.
-
What Security Terms Go in an Offer Letter? ISO 27001 vs SOC 2 vs NIST
offer letter security terms ISO 27001 SOC 2 NIST map employment security clauses to evidence that supports enterprise reviews and audits.
-
What Questions Should You Ask a Media Disposal Vendor?
Use these questions to ask a media disposal vendor about destruction methods, chain of custody, evidence, contracts, and ISO 27001 alignment.
-
What Google Cloud KPIs Show Health Plan Data Is Protected?
Use google cloud kpis for health plan data protection to prove encryption, access, backups, monitoring, and incident reporting are working.
-
What Does a Signed Acceptable Use Policy Need to Cover? (1-9-4)
Learn what employee acceptable use policy cybersecurity requirements must cover under ECC 2:2024 control 1-9-4, including signed acknowledgments and awareness.
-
What Do SIEM Logs Need to Include for Network Security? (2-5-3)
Network security management SIEM log requirements: the events, evidence, and approvals needed to support ECC 2:2024 practice 2-5-3.
-
What Do Auditors Look for in Microsoft 365 Event Triage?
What do auditors look for in microsoft 365 event triage? Clear assessment decisions, retained evidence, accountable owners, and incident escalation records.
-
What Clauses Require Subcontractors to Secure ePHI Workstations?
Use subcontractor contract clauses for ePHI workstations to require HIPAA-aligned use rules, physical safeguards, evidence, audit access, and termination.
-
What Caused the Shared Chromebook ePHI Incident? Postmortem
This shared Chromebook ePHI incident postmortem explains how an unsecured signed-in session exposed patient data and how to prevent recurrence.
-
What Caused a Google Apps Script Breach? Postmortem (SC.L2-3.13.13)
A google apps script breach postmortem showing how an unapproved OAuth-enabled script exfiltrated files and how to evidence SC.L2-3.13.13.
-
What Audit Log KPIs Should a Compliance Officer Report Monthly?
Use an audit log kpis monthly compliance report to show HIPAA log coverage, review completion, alert response, retention, and control gaps.
-
What Are Physical Access Requirements for Google Workspace Devices?
Learn hipaa physical access requirements google workspace devices: protect offices, endpoints, visitors, and emergency access under HIPAA.
-
What Are HIPAA Device and Media Control Requirements in Microsoft 365?
HIPAA device and media control requirements Microsoft 365: govern ePHI devices, removal, disposal, reuse, movement records, and backups.
-
What Are Audit Log Requirements for Patient Records? (164.312(b))
Understand audit log requirements for patient records under HIPAA 164.312(b), including what to log, who is covered, and practical evidence of compliance.
-
Vulnerability Scans vs Pen Tests: Start With Scans (2-10-3)
Vulnerability scans vs penetration tests for small business: start with scheduled scans, then use pen tests to validate high-risk exposure.
-
Using PowerShell to Remove Former Vendor Access
Use powershell remove former vendor access workflows to disable accounts, revoke sessions, remove group access, and retain audit evidence.
-
Using Amazon Macie to Find and Tag CUI Files in S3 (MP.L2-3.8.4)
Learn how using Amazon Macie to find and tag CUI files in S3 supports MP.L2-3.8.4 with discovery, tags, verification, and evidence.
-
Ultimate Guide to Off-Site Asset Security for MSSP Analysts
An off-site asset security guide for MSSP analysts: protect client devices and media away from premises with evidence-ready ISO 27001 controls.
-
The Ultimate Guide to USB Evidence in Defender (MP.L2-3.8.8)
Use this defender usb ownership evidence checklist to block unowned removable media and prove MP.L2-3.8.8 compliance with Azure evidence.
-
The Ultimate Guide to Remote Worker File Scans (SI.L2-3.14.5)
cmmc remote worker antivirus scanning requires defined periodic scans and real-time scanning of externally sourced files when downloaded, opened, or executed.
-
The Ultimate Guide to Email TLS for Patient Data
This email TLS for patient data ultimate guide explains HIPAA transmission security, implementation evidence, a testing checklist, and audit FAQs.
-
The Ultimate Guide to CMMC Password Vaults (IA.L2-3.5.10)
This cmmc password vault guide explains how to protect stored and transmitted passwords for CMMC IA.L2-3.5.10 with evidence-ready steps.
-
The Ultimate Guide to a Vulnerability Board Deck (2-10-3)
Build a vulnerability management board deck that translates ECC 2-10-3 evidence into business risk, remediation progress, and decisions.
-
Single Breach vs Pattern: Which Triggers a Vendor Cure Plan?
Single breach vs pattern vendor cure plan: HIPAA requires action when a known pattern creates material vendor contract violations.
-
Phishing Risk Policy Template for Employees (AT.L2-3.2.1)
Use this phishing risk policy template for employees to define reporting, training, testing, and evidence for CMMC Level 2 compliance.
-
Okta vs Entra ID: User Lifecycle Pricing for 50-User SaaS
Compare okta vs entra id user lifecycle pricing for 50-user saas, including tiers, M&A fit, ISO 27001 lifecycle controls, and alternatives.
-
Microsoft 365 CUI Access Policy Template: Screening Gates (PS.L2-3.9.1)
Use this Microsoft 365 CUI access policy template to document screening gates before authorizing access to CUI systems under PS.L2-3.9.1.
-
In-House vs MSP Maintenance: Which Pays Back Faster? (MA.L2-3.7.1)
Compare in-house vs msp maintenance cost, 12-month budgets, risk savings, and breakeven points for MA.L2-3.7.1 maintenance.
-
How to Set Up Continuous Microsoft 365 Security Alerts
Learn how to set up continuous microsoft 365 security alerts with prioritized telemetry, Sentinel queries, tuning, and incident response workflows.
-
How to Set Google Session Length in Admin Console (SC.L2-3.13.9)
Learn to set Google Workspace session length admin console policies, test expiration, and produce SC.L2-3.13.9 evidence for assessors.
-
How to Run a Test Data Leak Tabletop Exercise
Run a test data leak tabletop exercise to validate containment, notification, evidence, and ISO 27001 test-information controls.
-
How to Require HTTPS for PHI in Azure App Service in 30 Minutes
Learn to require https for phi azure app service with HTTPS Only, TLS 1.2, validation, and HIPAA evidence in 30 minutes.
-
How to Move Shared Clinic PCs to Badge Login in 30 Days
Run a hipaa shared clinic pc badge login migration in 30 days with a phased plan, rollback controls, and evidence for HIPAA workstation security.
-
How to Move From Untracked USBs to a Check-Out Log
Learn how to move from untracked USBs to a check-out log with a phased HIPAA-ready process for inventory, custody, encryption, and validation.
-
How to Generate Employment Security Clauses with PowerShell
Learn to generate employment security clauses with PowerShell using approved templates, HR data, audit logs, and review gates.
-
How to Destroy Keys Before Disk Disposal: Cloud KMS > Key Versions
How to cloud kms destroy key versions before disk disposal with Google Cloud steps, verification, and ISO 27001 evidence.
-
How to Build an Azure Asset Inventory in 2 Hours
Learn how to build an azure asset inventory in 2 hours using Azure Resource Graph, owners, and evidence for ISO 27001 5.9.
-
How to Approve Secure-Area Visitors in Microsoft Bookings
Configure Microsoft Bookings secure area visitor approval settings to require staff approval, document sponsor details, and retain visitor records.
-
How to Add ePHI Safeguards to Plan Documents in 60 Minutes
Use a focused amendment package to add ephi safeguards to group health plan documents and create assessment-ready evidence in 60 minutes.
-
Fire Suppression vs Fire Detection: Server Rooms Need Both
Fire suppression vs fire detection server room controls serve different purposes: detect and alert early, then contain or extinguish fire.
-
Does an Information Security Policy Need CEO Approval?
Does an information security policy need CEO approval? ISO 27001 requires management approval, not necessarily CEO sign-off.
-
DocuSign vs Ironclad: IP Agreement Pricing for Small Teams
docusign vs ironclad IP agreement pricing for small teams: DocuSign is cheaper for standard IP signatures; Ironclad suits complex contract workflows.
-
Cyber Incident vs Data Breach: Which Goes to the Prime? (IR.L2-3.6.2)
Cyber incident vs data breach prime contractor reporting: report contractually required incidents, not only confirmed breaches, and document every decision.
-
Can Vendor Escort Rules Reach a 2-Hour Baseline? (MA.L2-3.7.6)
Meet cmmc vendor escort requirements with a two-hour baseline: named escorts, restricted temporary access, and maintenance logs an assessor can verify.
-
Can Google Drive Store CUI With FIPS Encryption? (SC.L2-3.13.11)
Learn whether can google drive store cui with fips encryption, what evidence is needed, and how SC.L2-3.13.11 applies.
-
Are API Endpoints Included in Pen Test Scope? (2-11-3)
API penetration testing scope requirements 2-11-3 explicitly include APIs supporting Internet-facing services under ECC 2:2024.
-
7 Unauthorized-Use Checks: 3-Hour Assessment Quick Start (SI.L2-3.14.7)
Use this CMMC unauthorized use assessment checklist to define authorized activity, review evidence, and baseline SI.L2-3.14.7 in three hours.
-
7 SharePoint HIPAA Documentation Mistakes to Avoid
Avoid hipaa documentation mistakes sharepoint teams make: retain, secure, update, and make HIPAA records available for six years.
Full archive
Browse every guide by framework.
2,764 control-by-control guides, checklists, and news, organized by the framework you need.
See LakeRidge in action.
Talk with our team about your framework, your gaps, and the right plan.
Get a demo