Which Logs Prove Session Authenticity Maturity? (SC.L2-3.13.15)
Use session authenticity maturity evidence logs to score SC.L2-3.13.15 from ad hoc TLS proof to monitored, optimized mutual authentication.
Cybersecurity & Compliance
News and guidance on cybersecurity, regulation, and compliance for regulated businesses.
Need help putting this into practice? See our compliance services.
Cybersecurity & Compliance articles
-
What Security Terms Go in an Offer Letter? ISO 27001 vs SOC 2 vs NIST
offer letter security terms ISO 27001 SOC 2 NIST map employment security clauses to evidence that supports enterprise reviews and audits.
-
What Questions Should You Ask a Media Disposal Vendor?
Use these questions to ask a media disposal vendor about destruction methods, chain of custody, evidence, contracts, and ISO 27001 alignment.
-
What Does a Signed Acceptable Use Policy Need to Cover? (1-9-4)
Learn what employee acceptable use policy cybersecurity requirements must cover under ECC 2:2024 control 1-9-4, including signed acknowledgments and awareness.
-
What Do SIEM Logs Need to Include for Network Security? (2-5-3)
Network security management SIEM log requirements: the events, evidence, and approvals needed to support ECC 2:2024 practice 2-5-3.
-
What Do Auditors Look for in Microsoft 365 Event Triage?
What do auditors look for in microsoft 365 event triage? Clear assessment decisions, retained evidence, accountable owners, and incident escalation records.
-
What Caused a Google Apps Script Breach? Postmortem (SC.L2-3.13.13)
A google apps script breach postmortem showing how an unapproved OAuth-enabled script exfiltrated files and how to evidence SC.L2-3.13.13.
-
Vulnerability Scans vs Pen Tests: Start With Scans (2-10-3)
Vulnerability scans vs penetration tests for small business: start with scheduled scans, then use pen tests to validate high-risk exposure.
-
Using PowerShell to Remove Former Vendor Access
Use powershell remove former vendor access workflows to disable accounts, revoke sessions, remove group access, and retain audit evidence.
-
Using Amazon Macie to Find and Tag CUI Files in S3 (MP.L2-3.8.4)
Learn how using Amazon Macie to find and tag CUI files in S3 supports MP.L2-3.8.4 with discovery, tags, verification, and evidence.
-
Ultimate Guide to Off-Site Asset Security for MSSP Analysts
An off-site asset security guide for MSSP analysts: protect client devices and media away from premises with evidence-ready ISO 27001 controls.
-
The Ultimate Guide to USB Evidence in Defender (MP.L2-3.8.8)
Use this defender usb ownership evidence checklist to block unowned removable media and prove MP.L2-3.8.8 compliance with Azure evidence.
-
The Ultimate Guide to Remote Worker File Scans (SI.L2-3.14.5)
cmmc remote worker antivirus scanning requires defined periodic scans and real-time scanning of externally sourced files when downloaded, opened, or executed.
-
The Ultimate Guide to CMMC Password Vaults (IA.L2-3.5.10)
This cmmc password vault guide explains how to protect stored and transmitted passwords for CMMC IA.L2-3.5.10 with evidence-ready steps.
-
The Ultimate Guide to a Vulnerability Board Deck (2-10-3)
Build a vulnerability management board deck that translates ECC 2-10-3 evidence into business risk, remediation progress, and decisions.
-
Phishing Risk Policy Template for Employees (AT.L2-3.2.1)
Use this phishing risk policy template for employees to define reporting, training, testing, and evidence for CMMC Level 2 compliance.
-
Okta vs Entra ID: User Lifecycle Pricing for 50-User SaaS
Compare okta vs entra id user lifecycle pricing for 50-user saas, including tiers, M&A fit, ISO 27001 lifecycle controls, and alternatives.
-
Microsoft 365 CUI Access Policy Template: Screening Gates (PS.L2-3.9.1)
Use this Microsoft 365 CUI access policy template to document screening gates before authorizing access to CUI systems under PS.L2-3.9.1.
-
In-House vs MSP Maintenance: Which Pays Back Faster? (MA.L2-3.7.1)
Compare in-house vs msp maintenance cost, 12-month budgets, risk savings, and breakeven points for MA.L2-3.7.1 maintenance.
-
How to Set Google Session Length in Admin Console (SC.L2-3.13.9)
Learn to set Google Workspace session length admin console policies, test expiration, and produce SC.L2-3.13.9 evidence for assessors.
-
How to Run a Test Data Leak Tabletop Exercise
Run a test data leak tabletop exercise to validate containment, notification, evidence, and ISO 27001 test-information controls.
-
How to Generate Employment Security Clauses with PowerShell
Learn to generate employment security clauses with PowerShell using approved templates, HR data, audit logs, and review gates.
-
How to Destroy Keys Before Disk Disposal: Cloud KMS > Key Versions
How to cloud kms destroy key versions before disk disposal with Google Cloud steps, verification, and ISO 27001 evidence.
-
How to Build an Azure Asset Inventory in 2 Hours
Learn how to build an azure asset inventory in 2 hours using Azure Resource Graph, owners, and evidence for ISO 27001 5.9.
-
How to Approve Secure-Area Visitors in Microsoft Bookings
Configure Microsoft Bookings secure area visitor approval settings to require staff approval, document sponsor details, and retain visitor records.
-
Fire Suppression vs Fire Detection: Server Rooms Need Both
Fire suppression vs fire detection server room controls serve different purposes: detect and alert early, then contain or extinguish fire.
-
Does an Information Security Policy Need CEO Approval?
Does an information security policy need CEO approval? ISO 27001 requires management approval, not necessarily CEO sign-off.
-
DocuSign vs Ironclad: IP Agreement Pricing for Small Teams
docusign vs ironclad IP agreement pricing for small teams: DocuSign is cheaper for standard IP signatures; Ironclad suits complex contract workflows.
-
Cyber Incident vs Data Breach: Which Goes to the Prime? (IR.L2-3.6.2)
Cyber incident vs data breach prime contractor reporting: report contractually required incidents, not only confirmed breaches, and document every decision.
-
Can Vendor Escort Rules Reach a 2-Hour Baseline? (MA.L2-3.7.6)
Meet cmmc vendor escort requirements with a two-hour baseline: named escorts, restricted temporary access, and maintenance logs an assessor can verify.
-
Can Google Drive Store CUI With FIPS Encryption? (SC.L2-3.13.11)
Learn whether can google drive store cui with fips encryption, what evidence is needed, and how SC.L2-3.13.11 applies.
-
Are API Endpoints Included in Pen Test Scope? (2-11-3)
API penetration testing scope requirements 2-11-3 explicitly include APIs supporting Internet-facing services under ECC 2:2024.
-
7 Unauthorized-Use Checks: 3-Hour Assessment Quick Start (SI.L2-3.14.7)
Use this CMMC unauthorized use assessment checklist to define authorized activity, review evidence, and baseline SI.L2-3.14.7 in three hours.
-
7 NDA Inventory Mistakes Auditors Find Before Assessments
Avoid nda inventory mistakes before assessments by proving every required signer, agreement, version, and review cycle is complete for ISO 27001 6.6.
-
7 KPIs for Board Reports on Google Cloud ID Reuse (IA.L2-3.5.5)
Use google cloud identifier reuse board report kpis to show policy coverage, blocked reuse, exceptions, and residual access risk to directors.
-
7 Data Handling Maturity Levels for Microsoft 365 (2-7-3)
Use Microsoft 365 data handling maturity levels 2-7-3 to score controls, identify gaps, and plan a practical next improvement.
-
Which Entra ID Reports Do IAM Auditors Need? (2-2-3)
Use entra id iam audit reports to prove unique identities, MFA, authorization, privileged access, and access reviews for ECC 2-2-3.
-
What Training Records Get You to Baseline Compliance in 2 Hours?
Build training records for baseline compliance in two hours with a defensible ISO 27001 6.3 evidence pack for SMB customers.
-
What Training Do System Administrators Need for Software Installs?
Build a system administrator software installation training plan that proves secure, approved installs for ISO 27001 surveillance audits.
-
What Threat Intelligence Evidence Do Auditors Look for in SIEM Logs?
See which threat intelligence audit evidence siem logs demonstrate collection, analysis, action, ownership, and review for ISO 27001 assessments.
-
What Should an Azure Server Room Access Policy Template Include?
An azure server room access policy template should define who may enter, why, how access is logged, reviewed, and revoked.
-
What Should a Board Report Say About Secure Office Areas?
What should a board report say about secure office areas: status, business risk, trends, exceptions, and decisions required.
-
What Should a Board Dashboard Show About Privileged Tools?
A board dashboard privileged tools report should show control coverage, material exceptions, risk trends, accountable owners, and remediation dates.
-
What Network Segmentation Evidence Do Auditors Ask For?
Network segmentation audit evidence: the designs, rules, access records, changes, and test results that demonstrate ISO 27001 8.22.
-
What NDA Evidence Will Auditors Expect From Azure?
Azure NDA audit evidence should prove signed agreements, review dates, covered parties, and access controls tied to Azure identities.
-
What Is Your VLAN Segmentation Maturity Score?
Use this VLAN segmentation maturity assessment to score your network from ad-hoc to optimized and identify your next ISO 27001 action.
-
What Is Split Tunneling on a VPN Laptop? (SC.L2-3.13.7)
Learn what is split tunneling on a VPN laptop cmmc and how SC.L2-3.13.7 requires full-tunnel remote access.
-
What Is a Security Awareness RACI Matrix? (AT.L2-3.2.1)
A security awareness RACI matrix assigns ownership for CMMC AT.L2-3.2.1 training, policies, records, and leadership oversight.
-
What Do Assessors Check in CUI Repair Tickets? (MA.L2-3.7.3)
See the cmmc assessor CUI repair ticket evidence needed to prove off-site maintenance equipment was sanitized before release.
-
What Data Masking KPIs Should Google Cloud Admins Track?
Track google cloud data masking kpis for coverage, policy enforcement, access exceptions, audit evidence, and remediation to demonstrate ISO 27001 compliance.
-
What Caused the Ransomware Outage? Policy Review Postmortem
A ransomware policy review postmortem shows how stale access and backup exceptions turned one compromised account into a three-day outage.
-
What AWS Evidence Proves Data Center Entry Controls? (Artifact > Reports)
Use AWS Artifact physical entry controls evidence—current SOC reports and ISO certificates—to prove AWS data-center access controls to an ISO 27001 assessor.
-
What Are Vendor Vulnerability Management Duties? (2-10-3)
Vendor vulnerability management requirements 2-10-3 require approved scanning, risk classification, remediation, patching, and trusted vulnerability alerts.
-
What Are Storage Media Handling Requirements for USB Drives?
Storage media handling requirements for usb drives require controls for acquisition, use, transport, and secure disposal based on data classification.
-
What Alerts Should I Set for Windows Configuration Drift?
Set Windows configuration drift alerts for changes to admin access, security tools, firewall, audit policy, services, and logging.
-
Using Terraform to Assign Security Roles for Audit Evidence
Use terraform security role assignments to create controlled role allocations, approval records, and repeatable audit evidence for ISO 27001.
-
Using Sentinel Playbooks to Block Risky Sessions (AC.L2-3.1.12)
Microsoft Sentinel playbook block risky remote sessions by detecting risky sign-ins, revoking sessions, and preserving control evidence.
-
Using GitHub Actions to Check CISA KEV Daily (SI.L2-3.14.3)
Build a GitHub Actions CISA KEV daily check that records advisory review, matches affected assets, and opens actionable tickets for SI.L2-3.14.3.
-
Using BitLocker to Encrypt Laptops in 1 Hour
Learn to encrypt company laptops with bitlocker quickly using a one-hour baseline that supports ISO 27001 endpoint-device evidence.
-
Using Azure Site Recovery to Replicate VMs for Disaster Recovery
Configure azure site recovery replicate vms disaster recovery settings to maintain recoverable workloads during a regional or physical disruption.
-
Ultimate Guide to sudo Permissions and Command Logs (AC.L2-3.1.7)
Meet AC.L2-3.1.7 with sudo permissions privileged command audit logs that restrict elevation and preserve traceable evidence.
-
The Ultimate RACI Matrix for Diagnostic USB Media (MA.L2-3.7.4)
Use this diagnostic USB media RACI matrix cmmc guide to assign ownership, evidence, escalation, and review duties for MA.L2-3.7.4.
-
The Ultimate Guide to AWS Identity Federation (2-2-3)
This aws identity federation ultimate guide explains how to implement federated access, MFA, least privilege, PAM, and access reviews for ECC 2-2-3.
-
Testing Account Lockout Controls: The Ultimate Guide (AC.L2-3.1.8)
Use cmmc account lockout control testing to validate settings, collect evidence, and meet AC.L2-3.1.8 requirements.
-
Risk Register vs POA&M: Use Both in CUI RFPs (RA.L2-3.11.1)
Compare risk register vs POA&M for CUI RFPs: use the register to document assessed risk and the POA&M to track approved remediation.
-
Removable Media Vendor Questionnaire Excel Template (MP.L2-3.8.7)
Use this removable media vendor questionnaire template to evaluate supplier controls, score responses, and document MP.L2-3.8.7 evidence.
-
No, Azure MFA Alone Does Not End Admin Sessions (MA.L2-3.7.5)
azure mfa does not end admin sessions; meet MA.L2-3.7.5 by requiring MFA for remote maintenance and closing the connection when work ends.
-
NDA vs Confidentiality Clause: Use an NDA for Contractors
For nda vs confidentiality clause for contractors, use a signed NDA when access or sensitive information is involved; clauses are not enough.
-
How to Use Terraform to Enforce Secure App Settings (1-6-3)
Use terraform enforce secure application settings through reviewed plans, deployment gates, monitoring, and evidence for ECC 1-6-3.
-
How to Set Employee Security Terms in Entra ID Terms of Use
Use entra id terms of use employee security terms to require, record, and report employee acknowledgement of security responsibilities for ISO 27001.
-
How to Move SQL Server Data to Masked Views in 7 Steps
Follow sql server data masking migration steps to replace direct table access with controlled masked views, test safely, cut over, and validate ISO 27001 alignment.
-
How to Monitor Employee Security Reports in Microsoft Sentinel
Learn how to monitor employee security reports in microsoft sentinel with telemetry, alerts, tuning, and incident-response workflows.
-
How to Map Pen Test Findings to a Remediation Tracker (2-11-3)
Learn to map penetration test findings to remediation tracker with auditable ownership, due dates, retest evidence, and ECC 2-11-3 coverage.
-
How to Enable Defender for DevOps in Azure (1-6-3)
Learn to enable Microsoft Defender for DevOps in Azure and collect ECC 2:2024 1-6-3 evidence for development security reviews.
-
How to Build an Event Report Form in Microsoft Forms > New Form
Microsoft Forms security event report form setup steps for creating a timely ISO 27001 incident reporting channel in Microsoft 365.
-
How Long to Keep Scan Logs for a CMMC Audit? (MA.L2-3.7.4)
Learn how long to keep malware scan logs for cmmc audit: CMMC sets no fixed period; retain verifiable MA.L2-3.7.4 evidence for 12 months.
-
How AWS Audit Manager Maps CMMC Evidence to ISO 27001 (AU.L2-3.3.6)
Use an AWS Audit Manager CMMC ISO 27001 evidence crosswalk to reuse log-analysis evidence across CMMC, ISO 27001, SOC 2, and NIST CSF.
-
HashiCorp Vault for MFA-Gated SSH Session TTLs (MA.L2-3.7.5)
Use hashicorp vault mfa ssh session ttl controls to require MFA for remote maintenance and enforce short-lived SSH access.
-
Google Drive Source Code Access: The Ultimate Audit Guide
Use this google drive source code access audit guide to scope repositories, manage permissions, collect evidence, and test ISO 27001 control 8.4.
-
Does WPA2 Authentication Count as Wi-Fi Authorization? (AC.L2-3.1.16)
does wpa2 authentication count as wi-fi authorization cmmc? Only when approved access is enforced before connection under AC.L2-3.1.16.
-
Does Cloud Logging Alone Meet Software Monitoring Rules? (CM.L2-3.4.9)
Answer: does cloud logging meet cmmc software monitoring requirements? No—pair logs with installation controls, inventory, alerts, and evidence.
-
CUI Media Policy Template for Subcontractors: 7 Essential Clauses (MP.L2-3.8.4)
Use this CUI media policy template for subcontractors to mark CUI media, state distribution limits, assign ownership, and support MP.L2-3.8.4.
-
CloudTrail Lake vs CloudWatch for Fast Audit Review (AU.L2-3.3.5)
CloudTrail Lake vs CloudWatch CMMC audit review: use CloudWatch for four-hour alerting and Lake for durable investigation queries.
-
Can Microsoft Defender Replace a SIEM for Small IT Teams? (SI.L2-3.14.3)
See when can Microsoft Defender replace a SIEM for small IT teams and document SI.L2-3.14.3 without enterprise tooling.
-
Can Excel Replace GRC for Small-Team CUI Risk Reviews? (RA.L2-3.11.1)
excel vs grc software for cmmc cui risk assessment: a lean, auditable review process for small defense subcontractor teams.
-
Azure Security Awareness Policy Template: Key Clauses Explained
Use azure security awareness policy template key clauses to define training, reporting, evidence, and merger-transition responsibilities for Azure users.
-
Azure Policy vs Defender: Which Evidence to Save? (RA.L2-3.11.1)
Azure Policy vs Defender for Cloud risk evidence: save policy compliance, security findings, risk decisions, and dated assessment records.
-
AWS Shared Responsibility: Ultimate Guide for CMMC Teams (AT.L2-3.2.1)
Use this aws shared responsibility cmmc security awareness guide to map AT.L2-3.2.1 risks, responsibilities, policies, training, and evidence.
-
Are Passwords in Email or Teams Compliant? (IA.L2-3.5.10)
Are passwords in email compliant cmmc? Usually no: IA.L2-3.5.10 requires passwords to be cryptographically protected in storage and transit.
-
Are Certifications Required for Cybersecurity Analysts? (1-10-4)
Are certifications required for cybersecurity analysts? ECC 1-10-4 requires tailored training, professional skill access, and documented evidence.
-
7 KPIs for Your CUI Access Screening Dashboard (PS.L2-3.9.1)
CUI access screening dashboard KPIs show whether every CUI user was screened before access, where exceptions sit, and what leaders must fix.
-
7 Business Continuity Evidence Mistakes Auditors Find (3-1-3)
Avoid business continuity evidence mistakes by linking approved plans, cyber scenarios, DR tests, ownership, and review records to ECC 3-1-3.
-
What Training Do Maintenance Technicians Need? (MA.L2-3.7.1)
Maintenance technician training CMMC should cover authorized maintenance, patching, change records, access controls, and evidence for MA.L2-3.7.1.
-
What Should a USB Drive Policy Template Include?
A usb drive policy template should define approved devices, access rules, encryption, transport, disposal, exceptions, and review requirements.
-
What Should a Microsoft 365 Tabletop Exercise Test? (2-7-3)
Learn what to test in a microsoft 365 tabletop exercise, including data handling decisions, incident actions, owners, and evidence.
-
What Should a Cloud Backup Vendor Due Diligence Checklist Cover?
Use this cloud backup vendor due diligence checklist to verify security, recovery, evidence, and contract terms before trusting a provider.
-
What Should a Board See in an AWS CUI Repair Report? (MA.L2-3.7.3)
An aws cui repair report for board should show CUI exposure, sanitization evidence, exceptions, risk decisions, and trend metrics.
-
What Office Security KPIs Should You Track in BigQuery?
Track office security kpis BigQuery metrics for access reviews, visitor records, facility issues, and evidence of ISO 27001 control performance.
-
What Maintenance Records Should You Export From Jira? (MA.L2-3.7.1)
Export jira maintenance records for cmmc that prove maintenance was planned, performed, reviewed, and retained for assessment.
-
What Is Emergency Access During a Production Outage? (CM.L2-3.4.5)
cmmc emergency access during production outage requires documented, approved, and enforced controls for urgent system changes.
-
What Is a Logging RACI Matrix for IT, HR, Legal and Leadership?
Define logging raci matrix roles so IT, HR, Legal, security, and leaders can assign ownership for producing, protecting, and reviewing logs.
-
What Is a 30-Day Plan to Fix Missing App Security Requirements? (1-6-3)
Use this 30 day plan for application security requirements to document controls, test applications, harden releases, and produce ECC 1-6-3 evidence.
-
What Incident Evidence Does a 2-Person IT Team Need Without a SIEM?
Meet incident evidence requirements for small IT team without siem using retained logs, an evidence register, and a lightweight preservation process.
-
What GitHub Reports Prove Source Code Access Is Controlled?
github reports source code access audit evidence shows who can access repositories, what permissions they hold, and how access changes are reviewed.
-
What Does Compliant Scanning Look Like in Microsoft Defender? (SI.L2-3.14.5)
See how cmmc microsoft defender compliant file scanning meets SI.L2-3.14.5 with defined periodic scans and real-time external-file protection.
-
What Do Background Checks Cost per Employee? (PS.L2-3.9.1)
Estimate background check cost per employee CMMC at $95–$200 in year one, then calculate the budget, avoided-loss ROI, and buy-versus-build threshold.
-
What Counts as a Reportable Phishing Incident? (IR.L2-3.6.2)
Define a cmmc reportable phishing incident and show how to track, document, and notify the right people for CMMC Level 2.
-
What Contract Clauses Require 24-Hour Incident Reports?
Use contract clauses for 24-hour incident reporting to bind vendors and subcontractors to fast notice, evidence preservation, and audit rights.
-
What Clear Desk KPIs Should IT Managers Track Monthly?
Use clear desk kpis to track monthly to prove ISO 27001 clear desk and clear screen enforcement with audit-ready evidence and trends.
-
What Are Record Protection Requirements for Audit Logs?
Record protection requirements for audit logs require organizations to prevent loss, alteration, unauthorized access, and improper release of evidence.
-
What Are Cloud vs On-Prem sudo Audit Requirements?
Cloud vs on-prem sudo audit requirements: compare evidence, logging, retention, and operating tradeoffs for ISO 27001 privileged utility control.
-
What a Payroll Fraud Postmortem Taught Us About Dual Approval
A payroll fraud dual approval postmortem shows why independent review, separated permissions, and audit evidence stop payment diversion.
-
Using Azure Key Vault HSM for High-Sensitivity Data (2-8-3)
Azure Key Vault Managed HSM configuration secures high-sensitivity keys with HSM-backed generation, rotation, access control, and ECC 2-8-3 evidence.
-
Ultimate Guide to CUI Subcontractor Transfers (AC.L2-3.1.3)
Meet CUI subcontractor transfer requirements by authorizing, encrypting, documenting, and enforcing every approved CUI data flow.
-
SIEM vs IDS: Which Does a Small Business Need First?
siem vs ids for small business: start with a managed SIEM for broad monitoring, then add IDS when network-specific detection is needed.
-
Security Training vs Policy Sign-Off: Training Wins (AT.L2-3.2.2)
Security training vs policy acknowledgment: AT.L2-3.2.2 requires role-specific skills, not just a signed policy, to prove staff can perform assigned duties.
-
Security Alert vs Incident: Close Defender False Positives (IR.L2-3.6.2)
Understand microsoft defender alert vs incident: close benign Defender detections, document true incidents, and meet CMMC IR.L2-3.6.2 reporting.
-
Rippling vs BambooHR for Disciplinary Cases: Pricing by Size
Rippling vs BambooHR disciplinary case pricing by company size: compare costs, audit evidence, and the best ISO 27001 fit.
-
PowerShell Script to Enforce BitLocker on Remote Laptops
Use a powershell script to enforce bitlocker on remote laptops, escrow recovery keys, and produce ISO 27001 remote-working evidence.
-
PowerShell Script Policy Template for IT Teams (SC.L2-3.13.13)
Use this powershell script policy template to authorize, restrict, monitor, and document PowerShell use for CMMC Level 2 assessments.
-
Offboarding vs Role Transfer: Both Need Security Checklists
An offboarding vs role transfer security checklist distinguishes account closure from access redesign while preserving ISO 27001 evidence.
-
How to Turn an Excel Asset List Into a Compliant Register
A practical ISO 27001 playbook to migrate excel asset list to compliant asset register, assign owners, preserve evidence, and validate control 5.9.
-
How to Suspend Users in Cloud Identity After a Policy Violation
Use Google Cloud Identity to cloud identity suspend user after policy violation, revoke active sessions, and retain audit evidence for ISO 27001.
-
How to Require Remote MFA with Cloud Identity 2-Step Verification
Configure cloud identity 2-step verification remote mfa by enforcing 2SV for remote-access users and retaining ISO 27001 evidence.
-
How to Move from Ad Hoc Offboarding to a 30-Day Exit Plan
Learn how to create a 30 day employee exit plan with a practical migration path, cutover runbook, evidence, and ISO 27001 controls.
-
How to Monitor Outsourced Developers: Azure Monitor > Activity Log
Use azure monitor outsourced developers activity log to export, alert on, and retain contractor Azure changes for ISO 27001 8.30 evidence.
-
How to Build a Google Workspace Mobile Device Compliance Dashboard (AC.L2-3.1.18)
Build a Google Workspace mobile device compliance dashboard with KPI targets, data sources, and reporting evidence for CMMC AC.L2-3.1.18.
-
How to Automate Entra Named Locations with PowerShell (2-5-3)
Learn how to automate entra named locations powershell with idempotent Microsoft Graph scripts, approvals, logging, and rollback controls.
-
How Mature Is Your Azure Authority Contact Process?
Use an azure authority contact maturity assessment to score ISO 27001 A.5.5 processes and plan the next 90 days of improvement.
-
Google Workspace NDA Requirements: The Ultimate Guide
Google workspace nda requirements: document, sign, review, and retain confidentiality agreements for users who access sensitive information.
-
Google Workspace Audit Log Timestamp Clause Template (AU.L2-3.3.7)
Use this google workspace audit log timestamp clause template to require synchronized audit timestamps from subcontractors supporting CMMC Level 2 work.
-
Google Cloud vs On-Prem: Proving Session Lock Evidence (AC.L2-3.1.10)
google cloud vs on prem session lock audit evidence: compare enforceable settings, proof sources, and tradeoffs for CMMC AC.L2-3.1.10.
-
GitHub Actions to Scan Test-Tool ZIPs Before USB Release (MA.L2-3.7.4)
Use GitHub Actions scan test tool ZIPs before USB release with malware checks, hashes, signed evidence, and a controlled approval gate.
-
Exposed Docker API: Lessons From a Crypto Mining Incident (CM.L2-3.4.7)
How an exposed Docker API crypto mining incident happens, what CM.L2-3.4.7 requires, and the practical fixes that prevent recurrence.
-
Do Microsoft 365 Licenses Include Clock Sync? (AU.L2-3.3.7)
Does microsoft 365 include clock synchronization? No—learn the incremental cost, ROI, and budget for AU.L2-3.3.7 compliance.
-
Defender for Cloud Risk Reviews: The Ultimate Guide (RA.L2-3.11.1)
Use defender for cloud CUI risk assessment evidence to document recurring RA.L2-3.11.1 risk reviews, decisions, and remediation.
-
CUI Notice Software Pricing by Company Size: 10 Vendors (AC.L2-3.1.9)
Compare CUI notice software pricing by company size, including 10 vendor options for NIST 800-171 AC.L2-3.1.9 system-use notices.
-
Create Employee Security Terms in Entra ID: Exact Menu Path
Learn how to create employee security terms in entra id, require acceptance with Conditional Access, and collect ISO 27001 audit evidence.
-
Cloud vs On-Prem Antivirus Costs for Small Contractors (SI.L2-3.14.5)
cloud vs on-prem antivirus costs small defense contractor: compare SI.L2-3.14.5 licensing, operations, scan evidence, and deployment choices.
-
Build vs Buy USB Control: 3-Year TCO and Payback (AC.L2-3.1.21)
Calculate build vs buy usb device control total cost of ownership, 3-year payback, and a defensible AC.L2-3.1.21 budget.
-
Azure Storage SAS Link: CUI Disclosure Postmortem (SC.L2-3.13.8)
An azure storage sas link cui disclosure postmortem showing how weak SAS and TLS controls exposed CUI and how to correct SC.L2-3.13.8 failures.
-
Are Guest Accounts Covered by Inactivity Rules? (IA.L2-3.5.6)
CMMC guest account inactivity requirements require guest identifiers to be disabled after a defined period without use.
-
7 Google Cloud Security Review Mistakes vCISOs Must Avoid
Avoid google cloud security review mistakes that weaken independent oversight, audit evidence, and risk decisions across your GCP environment.
-
What Does Secure Equipment Siting Mean for Azure Admins?
Secure equipment siting meaning for Azure admins: protect the devices and locations that support Azure services under ISO 27001 7.8.
-
What Caused Our Azure Offboarding Incident? A Postmortem
This azure offboarding incident postmortem shows how a missed role removal left production access active and what controls prevent recurrence.
-
What Caused an Unowned USB Breach in Intune? (MP.L2-3.8.8)
Learn why an unassigned USB bypassed Intune, exposed CUI, and the intune unowned usb breach lessons learned needed for MP.L2-3.8.8.
-
What Cabling Security Questions Belong in a Google Workspace RFP?
Use google workspace rfp cabling security questions to evaluate providers against ISO 27001 7.12 cabling protection requirements.
-
Using Google Docs eSignature for Employment Security Terms
Configure Google Docs eSignature employment security terms workflows to document acceptance of ISO 27001 information-security responsibilities.
-
Using GAM to Add Screened Users to Google Groups (PS.L2-3.9.1)
Use GAM add approved users to Google Workspace groups from a screening-approved roster with auditable checks for CMMC PS.L2-3.9.1.
-
Using Cloud KMS to Destroy CUI Keys Before Repair (MA.L2-3.7.3)
Use Google Cloud KMS destroy encryption keys before repair to make CUI on encrypted equipment inaccessible before off-site maintenance.
-
Ultimate Guide to Wi-Fi 802.1X Authentication (SC.L2-3.13.15)
Wi-Fi 802.1X authentication ultimate guide for implementing mutual wireless access controls and evidence for CMMC SC.L2-3.13.15.
-
The Ultimate Guide to Web Filtering with DNS Filters
This web filtering dns filters ultimate guide explains how to reduce malicious website exposure, implement controls, and evidence ISO 27001 compliance.
-
Network Cable Security: Ultimate Guide for SMB Audit Teams
This network cable security ultimate guide explains how SMBs protect power and data cabling for ISO 27001 audit evidence.
-
Manual Log Review vs MDR: MDR Does Not Replace Review (AU.L2-3.3.3)
Cmmc manual log review vs mdr: MDR can monitor alerts, but it does not replace reviewing and updating logged event types for AU.L2-3.3.3.
-
How to Move From No Incident Plan to a 30-Day SaaS Playbook
Use a 30-day, evidence-driven process to move from no incident plan to SaaS incident response playbook readiness for enterprise reviews.
-
How to Migrate Web Servers to FIPS TLS (SC.L2-3.13.11)
A step-by-step plan to migrate web server TLS to FIPS validated cryptography, validate modules, cut over safely, and retain evidence.
-
How to Migrate Shared sudo Access to Break-Glass Accounts
A phased playbook to migrate shared sudo access to break glass accounts with audit evidence, rollback steps, and ISO 27001 controls.
-
How to Fix Missing Incident Response Procedures After an Audit
Learn how to fix missing incident response procedures audit finding with scoped playbooks, proof of use, ownership, and review evidence.
-
How to Block Unauthorized Apps in 4 Hours with WDAC (CM.L2-3.4.8)
Use a WDAC block unauthorized apps CMMC quick start to enforce a documented deny list and collect CM.L2-3.4.8 evidence in four hours.
-
How to Block Legacy Auth: Entra > Conditional Access (2-2-3)
Learn how to block legacy authentication in Microsoft 365 Entra Conditional Access with a tested policy, verification steps, and assessor evidence.
-
Google Workspace Maintenance Policy Template: Maintenance Log Clauses (MA.L2-3.7.1)
Use this google workspace maintenance log policy template to document maintenance, ownership, evidence, and review requirements for MA.L2-3.7.1.
-
Google Admin Wipe vs. Powerwash for One-Admin CUI Repairs (MA.L2-3.7.3)
Google Admin wipe vs Powerwash CUI repair: choose remote wipe when online, document local resets, and prove MA.L2-3.7.3 with simple records.
-
GitHub Enterprise Cloud vs Server for Secure Code Reviews
github enterprise cloud vs server secure code reviews: choose Cloud for lower operational burden or Server for strict isolation and controlled hosting.
-
Does a Ransomware Scenario Belong in CUI Risk Reviews? (RA.L2-3.11.1)
Yes. A ransomware scenario cui risk assessment helps demonstrate periodic, documented risk review for CUI systems under RA.L2-3.11.1.
-
7 Google Cloud Vulnerability Myths Auditors Reject (2-10-3)
google cloud vulnerability management compliance myths 2-10-3: what ECC 2-10-3 requires beyond scanning and patching.
-
14+ Security Settings to Boost WhatsApp Privacy
Configure these settings to combat stalkers, spammers, and everyone else annoying you on WhatsApp.
-
How to Get Your Smartphone Ready for the Next Disaster
If configured correctly, during a disaster a smartphone can be more than a communication device.
-
DeepSeek AI Database Leaked Secret Keys & Over 1 Million Log Lines
DeepSeek AI database security flaw uncovers confidential keys, chat records, and backend information, providing unfettered access to the entire system.
-
Russian hacker group Star Blizzard launch spear phishing attack via WhatsApp
The Russian hacker group Star Blizzard posed as U.S. government officials in fraudulent emails, urging recipients to join a WhatsApp group supposedly dedicated to showcasing "the most recent non-governmental initiatives supporting Ukrainian NGOs."
-
Biden executive order imposes new cybersecurity standards for companies that do business with the U.S. government
The Biden administration aims to enhance digital security for both the government and private sector in the United States through the implementation of this executive order.
-
Telegram Hands Over Thousands Of Users Data To US Law Enforcement
The arrest of the Telegram founder seems to have caused concern among those who use the platform for child exploitation, as it has had a notable impact.
-
Volkswagen data leak exposes location of 800,000 electric car drivers
A Volkswagen subsidiary data breach has exposed the location and other information of 800,000 electric vehicle owners for several months.
-
US Army soldier arrested for hacking President Donald Trump’s calls
US Army soldier shared on the Telegram messaging service that they had breached the security of over 15 telecom providers through hacking.
-
US Treasury documents stolen by Chinese Hackers in Major Incident
Hackers supported by the Chinese government successfully penetrated the Treasury Department's computer security protocols, as stated in a letter sent to lawmakers.
-
Ensure that between two and four global admins are designated - Microsoft 365
Designate between two and four global administrators to ensure effective management and security within your Microsoft 365 environment.
-
Establish two emergency access accounts for critical situations, ensuring continuity and security in your system - Microsoft 365
Secure your Microsoft 365 environment by ensuring administrative accounts are distinct and solely cloud-based, enhancing control and minimizing risks.
-
Ensure that administrative accounts are distinct and solely cloud-based - Microsoft 365
Secure your Microsoft 365 environment by ensuring administrative accounts are distinct and solely cloud-based, enhancing control and minimizing risks.
-
BYOD - Do employees care about data security?
According to a survey conducted by Kaspersky Labs, only 10% of employees are diligent in safeguarding work-related information on their personal devices.
-
4 Stages of Containing a Data Breach
Data breaches have become increasingly common, leading many organizations to establish comprehensive policies for handling them. In 2015, Anthem Blue Cross Blue Shield, a prominent US health insurance provider, disclosed a significant breach, revealing that approximately 78.8 million Social Security records and other sensitive personal data had been compromised. We look at four stages of containing a data breach.
-
5 Reasons Why Your Business Needs a Pen Test
Penetration testing is a highly effective method for evaluating your organization's existing cyber security measures (ISO 27001, NIST SP 800-171, HIPAA). Here are 5 crucial reasons to conduct a penetration test
-
Evidence Remotley Wiped From Police Station
Placing phones in a microwave prevents hacking?
-
Telehealth
Telehealth, what is it? how does it work? Telehealth explained.
-
Healthcare Cybersecurity
An In-depth Look at Cybersecurity in the US Healthcare Industry through Facts and Statistics
-
Flying to the Cloud – IT & Security Transformation
Learn how we configured a client's Microsoft 365 environment to meet NIST SP 800-171 requirements and moved their on-premise resources to the Microsoft 365 environment
-
Maintaining Systems and Compliance
Learn how our Azure AD services can streamline and secure your IT environnment.
-
Data Mining and Extracting Historical Data
How we helped a regional logistics company access historical data and provide the tools to mine it for information
-
Email marketing automation platform = six figure increase in sales
How we helped a small business increase their sales by six figures and in salary cost using a custom built email marketing automation platform
-
Certification after Certification
Learn how our policies and procedures service enabled a customer to earn two cybersecurity accreditations.
-
The Physics Behind Microsoft 365 Security
Learn how we helped a DoD contractor meet compliance requirements by securing their Microsoft 365 tenant.
-
Looking for an Information Security Framework? Use this.
Using a security frame helps an organization establish and meet its security objectives.
-
Cyberwarfare vs Cyber Espionage, What is the Difference?
Cyber buzzwords always get thrown around causing confusion for readers.
-
Top 5 In Demand Cybersecurity Certifications
Which of these top 5 cybersecurity certifications do you have?
-
Data Classification Labels for Your Small Business
Having trouble with data classification in your small business? Here are three classification labels you can use.
-
10 Ways to Improve Your Small Business's Cybersecurity
Perform these tasks to greatly improve cybersecurity at a small business.
-
How I Passed the CISSP Exam on My First Try
Follow my tips on how to pass the CISSP exam.
-
System Security Plans Explained
To meet NIST SP 800-171 requirements you must create and maintain a system security plan (SSP).
-
Easy to Use Incident Response Checklist
Organizations should have standardized procedures for responding to incidents, use this incident response checklist next time you respond to an incident.
-
How to Create a Hardware and Software Inventory for your System Security Plan
Every system security plan should include or reference a hardware and software inventory.
-
What is a Collaborative Computing Device?
Learn what a collaborative computing device is and how to meet your NIST SP 800-171 and CMMC requirements.
-
Digital Bug Out Bag Essentials
Are you preparing for a natural disaster, civil unrest, nuclear holocaust, or zombie apocalypse? If so, you need a digital bug-out bag.
-
Cybersecurity Border Crossing and Travel Tips
When traveling or crossing through border controls there are a few cybersecurity tips and best practices you should follow.
-
Easy to Follow Online Privacy Guide
Learn how to clean up your online presence and stay anonymous.
-
Data Classification 101 Guide
Classifying and labeling data is a critical part of any mature cybersecurity program.
-
Is it Cybersecurity or Cyber Security? How do you spell it?
Is cybersecurity spelled as one word or two? The answer is it depends...
-
The Principle of Least Functionality, Simplicity is the Ultimate Sophistication
Employing the principle of least functionality is critical for organizations seeking to reduce their cyber risk.
-
.png)
Information Security or Cyber Security? Which term should we use?
The term cyber security is often heard in the media, government circles, and the information technology community. Is the term being used incorrectly?
-
The History of Hacking: 1903 the world's first Hack
In 1903 the world’s first hacking incident occurred, marking the start of an era. At the Royal Academy of Sciences in England, Nevil Maskelyne pulled off an unharmful yet very embarrassing hack.
-
5 Open-source Cybersecurity Tools Every Company Needs
Using free and open-source software (FOSS) to meet your cybersecurity needs is a great way to improve your organization’s cybersecurity posture without emptying your wallet. Here are 5 open source cybersecurity tools your company can leverage.
-
6 Cybersecurity Risks Associated with Working From Home
Although an operational necessity, allowing employees to work from home increases cyber risk. We cover six cyber risks and offer mitigations.
-
Laptops given to British school kids came preloaded with malware
Laptops supplied to British schools by the Department for Education came preloaded with malware. Yes you read that right...
-
12 Things You Need to Know About the Signal Messenger App
The Signal Messenger App is rising in popularity. Here are some common questions people have about it.
-
5 Simple Ways to Improve Your Organization’s Cybersecurity
Tackling cybersecurity challenges is no walk in the park. However, you can use these five simple actions to improve cybersecurity at your organization.
-
Signs an Employee Might Be an Insider Threat
More than 34% of businesses around the globe are affected by insider threats yearly.[1]
-
Why Ad Blockers Should Be Part of Your Endpoint Security Strategy
Malvertising is a serious threat that can often be overlooked. Ad blockers can help mitigate this threat.
-
How to Protect Printers From Cyber Threats
We are used to locking down workstations and servers however we often overlook printers. Here is how to secure your printers.
-
How Going Paperless Improves Cybersecurity
Want to help save the environment and improve your information security? Then go paperless.
-
4 Reasons Small Business Doesn't Invest in Cybersecurity
Small businesses are often the target of cyber attacks. Why don't they take cybersecurity as seriously as they should?
-
3 Free Ways to Boost Cybersecurity Awareness
Training employees on cybersecurity practices and reminding them of security threats is paramount for any successful program.
-
Should You Punish Employees for Cybersecurity Violations?
Everyone can agree that breaking the rules should have its consequences but is punishing users for cybersecurity policy violations and mishaps a good idea?
-
Physical Security Measures are an Important Part of Cybersecurity
Our data may be stored digitally but fundamentally it is still very much linked to the physical world. Here is how to bolster cybersecurity through physical security.
-
What is Split Tunneling? Should You Allow It?
What is split tunneling as it relates to virtual private networks? Is using split tunneling secure? How does it impact CMMC compliance requirements?
-
What is FIPS 140-2?
What is FIPS 140-2? Why was it created? Which encryption algorithms are FIPS 140-2 compliant?
-
5 Free Apps & Services To Protect Your Privacy
Tired of Silicon Valley and the Government tracking your every move? Use these free apps and services to help protect your privacy.
-
Practical Home Cybersecurity Tips
Use these tips to protect your home from cyber threats.
-
How Often Should Users Be Required to Reset Their Password?
Does requiring users to reset their passwords every few months promote better security or does it reduce security?
-
What is the difference between "Separation of Duties" and "Least Privilege"
Separating the duties of employees and implementing the principle of least privilege is vital to any cybersecurity program but what is the difference between the two?
-
What is the Difference Between Data Privacy and Security?
Privacy and security are related but what is the difference?
-
FALSE: Hiding your WiFi SSID is more secure than not, and here's why:
Does hiding your SSID improve security?
-
Do You Need Antivirus for Mac?
Does a Mac need antivirus? A lot of people believe that Macs don’t need it. Where did this belief come from? Is it true?
-
How to Create A Business Impact Analysis (BIA)
We discuss business impact analysis definition, steps, and provide templates from NIST.
-
How to Choose an Enterprise Grade Multi-factor Authentication (MFA) Solution
Knowing how to choose the right multi-factor authentication (MFA) solution to meet your company's compliance and security needs can save you a lot of time down the road.
-
Cheat Sheets Every Cybersecurity Pro Needs
Check out these useful cheat sheets for cybersecurity tools like NMAP, Wireshark, and more!
-
What is an Incident Response Plan? What Should it Contain?
The occurrence of a cybersecurity incident isn’t a matter of if but when. Organizations need to have incident response plans in place. So what is an incident response plan?
-
What is the NIST Privacy Framework?
The NIST Privacy Framework provides organizations with a tool to manage privacy risks. How can it benefit your organization?
-
Use This Simple Trick to Prevent 94% of Windows Vulnerabilities
By revoking administrator rights from a Windows system you can remediate 94% of vulnerabilities affecting the Windows operating system. Here’s how.
-
What is a Brute force attack?
A brute force attack uses trial and error to guess login information such as passwords with the hope of eventually guessing it correctly.
-
What's the Difference Between SSL and TLS?
In short, SSL is the now deprecated predecessor of TLS.
-
What is Malware?
Malware is a broad term for any type of harmful software designed to exploit a device, service or network.
-
Practicing Good OpSec on Social Media
Social media can help you connect with friends and family, it can also be a way for bad actors to connect with you.
-
Building a Patch and Vulnerability Management Program
A patch and vulnerability management program is one of the most important parts of any cybersecurity program. In this post I explain how to build one.
-
Why Your Company Needs to Block Browser Extensions
Browser extensions can increase productivity, however, left unmanaged they can create security risks for your organization.
-
Top 5 Phishing Statistics
Here are the top 5 most shocking phishing statistics.
-
How to Provide Free Cybersecurity Training to Your Employees
Your employees can receive some of the same training as Pentagon employees at no cost to you.
-
How to Protect Your Smartphone from Hackers
Continue reading to find out how to prevent hackers from taking over your phone.
-
How to Protect Your Twitter Account From Hackers
Learn to how to secure your twitter account to avoid being hacked.
-
7 Small Business Cybersecurity Statistics You Need to Know
Here are the top small business cybersecurity statistics you need to know.
-
Successful Cybersecurity Programs Focus on the Basics
Companies often overlook the basic elements of cybersecurity, leaving them vulnerable to attack.
-
Top 10 Useful Cybersecurity Statistics for 2020
Here are the top 10 recent cybersecurity statistics you need to know for 2020.
-
How to Control Portable Storage Devices
77 percent of corporate end-users surveyed have used personal flash drives for work-related purposes.
-
How to Create a System Security Plan (SSP)
A system security plan (SSP) lists an organization’s cybersecurity requirements and explains how it meets them. We will show you how to create your own SSP!
-
Use DISA STIGs to Secure Your IT Systems
The Defense Information Systems Agency (DISA) has a wide range of security technical implementation guides (STIGS) company’s can leverage to secure their IT systems.
-
How to Sanitize or Destroy Digital & Non-Digital Media
Did you know that 42% of used drives sold on eBay hold sensitive data?
-
How to Create an IT Acceptable Use Policy + Templates
Creating an acceptable use policy for your information system is a good way of informing users of your security policies and limiting legal risks.
-
Change Control - Important Considerations Before Making Changes to your IT Systems
Change control procedures are the backbone of any mature cybersecurity program. We offer a list of items IT teams should consider before deploying changes to their production environment.
-
What is an information system?
Understanding what an information system is and its components is critical to effectively implementing your company’s CMMC requirements.
-
America's Plan to Protect its Defense Industry from Cyber Threats
America will protect its defense industrial base from cyber attacks with a new cybersecurity framework and an army of assessors.
See LakeRidge in action.
Talk with our team about your framework, your gaps, and the right plan.
Get a demo