Governance, risk & compliance, explained
Practical, no-jargon guides to the frameworks and concepts behind a real compliance program. Each one answers a question directly, then shows you how to act on it, written for the people actually doing the work at small and mid-sized companies.
Frameworks
What is SOC 2?
SOC 2 is an independent audit report, defined by the AICPA, that shows how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current version, ISO/IEC 27001:2022, pairs management-system requirements (clauses 4–10) with 93 Annex A controls grouped into four themes.
What is HIPAA?
HIPAA is a US law that sets national standards for protecting health information. Its Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI), and its Breach Notification Rule governs what happens after a breach.
What is the NIST Cybersecurity Framework (CSF)?
The NIST Cybersecurity Framework is a voluntary, risk-based framework for managing cybersecurity. Version 2.0 (2024) is organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
What is PCI DSS?
PCI DSS is the Payment Card Industry Data Security Standard: a set of 12 core requirements for any organization that stores, processes, or transmits cardholder data. The current version is PCI DSS v4.0.1.
What is CMMC?
CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense program that requires contractors in the defense industrial base to prove they protect federal contract information and controlled unclassified information. CMMC 2.0 has three levels.
What are the CIS Controls?
The CIS Critical Security Controls are a prioritized set of 18 safeguards, published by the Center for Internet Security, that defend against the most common cyber attacks. Version 8 organizes them into three Implementation Groups so smaller organizations can start with the essentials.
What is GDPR?
The GDPR (General Data Protection Regulation) is the European Union’s data-protection law. It governs how organizations process the personal data of people in the EU and EEA, grants individuals strong rights over their data, and requires breach notification, generally within 72 hours.
What is an ISMS?
An ISMS (information security management system) is the set of policies, processes, roles, and controls an organization uses to manage information security risk in a structured, repeatable way. It is the central concept of ISO/IEC 27001.
What is a Statement of Applicability?
A Statement of Applicability (SoA) is the ISO 27001 document that lists the Annex A controls, states which ones apply to your organization, whether each is implemented, and the justification for including or excluding it.
What is a compliance crosswalk?
A compliance crosswalk is a mapping that shows how a single control satisfies the requirements of multiple frameworks at once, so evidence collected for one framework can be reused for others instead of rebuilt from scratch.
What is FedRAMP?
FedRAMP (the Federal Risk and Authorization Management Program) is a US government program that standardizes how cloud services are security-assessed and authorized for use by federal agencies, using a control baseline drawn from NIST SP 800-53.
What is SOX compliance?
SOX compliance means meeting the requirements of the US Sarbanes-Oxley Act of 2002, which requires public companies to maintain and assess internal control over financial reporting. Section 404 in particular drives IT general controls over the systems behind the financials.
Risk
What is a risk register?
A risk register is a living record of the risks an organization has identified, each scored on likelihood and impact, assigned an owner and a treatment, and tracked over time. It is the backbone of a risk-management program and a requirement of frameworks like ISO 27001 and SOC 2.
What is a data protection impact assessment (DPIA)?
A data protection impact assessment (DPIA) is a documented risk assessment required under GDPR Article 35 when a type of processing is likely to result in a high risk to individuals' rights and freedoms, used to identify and reduce that risk before processing begins.
Vendor risk
What is vendor risk management?
Vendor risk management (also called third-party risk management, or TPRM) is the practice of identifying, assessing, and continuously monitoring the risks that your suppliers and service providers introduce, from data breaches to outages to compliance gaps.
What is a security questionnaire?
A security questionnaire is a set of questions a customer sends a vendor to assess how the vendor protects data, covering areas like access control, encryption, incident response, and compliance, as part of vendor due diligence.
What is a trust center?
A trust center is a public web page where a company shares its security posture, compliance reports, policies, and subprocessors so prospective and current customers can vet it quickly, reducing back-and-forth during security review.
What is a subprocessor?
A subprocessor is a third party that a service provider (a processor) engages to process personal data on its behalf, such as a hosting, email, or analytics provider. Under GDPR, a processor may only use subprocessors with the customer's authorization.
AI governance
What is AI governance?
AI governance is the set of policies, controls, and oversight that keep an organization’s use of artificial intelligence safe, fair, transparent, and accountable. Emerging standards include ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act.
What is ISO 42001?
ISO/IEC 42001:2023 is the first international management-system standard for artificial intelligence, an AI Management System (AIMS). It gives organizations a certifiable way to govern the responsible development and use of AI, using the same management-system structure as ISO 27001.
What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s law on artificial intelligence. It takes a risk-based approach: it prohibits certain AI practices, sets strict requirements for high-risk systems, adds transparency duties for some uses, and creates obligations for general-purpose AI models.
What is the NIST AI Risk Management Framework?
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework for managing the risks of AI. Released in 2023, it is organized around four functions, Govern, Map, Measure, and Manage, to help organizations build trustworthy and responsible AI.
Security fundamentals
What is evidence collection in compliance?
Evidence collection is the practice of gathering and maintaining the artifacts, screenshots, logs, tickets, policies, and records, that prove your controls actually operate. It is what turns “we do this” into something an auditor can verify.
What are access reviews?
An access review (or user access review) is a periodic check that confirms each person still has only the access they need, and that access is revoked when it isn’t. It is a core control for SOC 2, ISO 27001, and least-privilege programs.
What is the principle of least privilege?
The principle of least privilege means giving each user, system, or process only the minimum access it needs to do its job, and nothing more. It limits the damage any single account or compromise can cause.
What is an incident response plan?
An incident response plan is a documented, practiced process for detecting, containing, and recovering from security incidents, and for communicating during them. Frameworks like SOC 2 and ISO 27001 expect one, and it is what keeps a bad day from becoming a catastrophe.
What is data classification?
Data classification is the practice of sorting data into sensitivity levels, commonly Public, Internal, Confidential, and Restricted, so you can apply the right protection to each. It is the foundation for access control, encryption, and retention decisions.
What is encryption?
Encryption converts readable data into ciphertext that only someone with the right key can decode. In practice you encrypt data in transit (with TLS) and at rest (often with AES-256), and the security depends heavily on how you manage the keys.
What is continuous monitoring?
Continuous monitoring is the ongoing, largely automated checking of your controls, configurations, and evidence so that drift and issues are caught in near real time, rather than discovered once a year at audit. It keeps a compliance program true between audits.
What are business continuity and disaster recovery?
Business continuity (BC) is the plan to keep your business running through a disruption; disaster recovery (DR) is the subset focused on restoring IT systems and data. Both are shaped by a business impact analysis and by recovery targets called RTO and RPO.
What makes a good password policy?
Modern guidance (from NIST SP 800-63B) favors longer passwords and passphrases over forced complexity, screening passwords against known-breached lists, dropping arbitrary periodic rotation, and layering multi-factor authentication on top. Length and MFA beat complexity rules.
What is zero trust?
Zero trust is a security model that assumes no user or device is trusted by default, even inside the network, and verifies every access request based on identity, device health, and context. Its guiding idea is "never trust, always verify."
What is a security control?
A security control is a safeguard or countermeasure, technical, administrative, or physical, that reduces information security risk by preventing, detecting, or correcting a threat.
What is multi-factor authentication (MFA)?
Multi-factor authentication (MFA) requires two or more independent factors to sign in, typically something you know (a password) plus something you have (a device) or something you are (a biometric), so a stolen password alone is not enough to get in.
What is penetration testing?
A penetration test is an authorized, simulated attack on your systems by a skilled tester who tries to exploit weaknesses the way a real attacker would, to find and prove exploitable vulnerabilities before someone malicious does.