Compliance and regulation — topics
Compliance, regulatory, and audit-framework notes from a practitioner’s perspective — what each regime asks for, how to map it to controls you already build, and where the technical-vs-policy distinctions matter.
Common standards / regimes
- pci-dss-4-implementation — PCI DSS 4.0 for handling cardholder data
- hipaa-security-rule — US healthcare data
- nis2-implementation — EU critical-infrastructure directive
- gdpr-incident-implications — incident-response obligations under GDPR
- soc2-vs-iso27001 — comparing the two big audit frameworks
Regional regulatory
- pdpa-singapore — Singapore PDPA
- appi-japan — Japan APPI
- lgpd-brazil — Brazil LGPD
- dpdp-india — India DPDP Act
Auditor / certification careers
- security-auditor-career-track — overall profession
- iso-27001-lead-auditor-certification — ISO 27001 LA
- pci-qsa-career-track — PCI QSA
- soc2-auditor-track — SOC 2 attestation (CPA-led)
- ciso-vciso-track — CISO and vCISO
- grc-analyst-career-track — GRC analyst
- cisa-cism-cissp-comparison — management / audit certifications
- internal-audit-vs-external-audit — function distinction
Audit practitioner workflow
- audit-evidence-sampling-and-scoring
- policy-and-standards-writing
- building-an-iso27001-isms-practitioner
- building-a-pci-dss-program-practitioner
- third-party-risk-management-practitioner
- tabletop-exercise-design-and-execution
Vulnerability management
- vulnerability-management-lifecycle
- cvss-epss-kev-prioritisation
- vuln-exception-management
- patch-management-program
- asset-management-easm-cmdb