Thinking on cybersecurity, compliance, and managed defence - from the CyberCheck team.
Software Bills of Materials have gone from a niche compliance artifact to something regulators and enterprise customers increasingly require by name, and that rapid mandate-driven adoption has outpaced a clear, shared understanding of what an SBOM actually tells you — and, just as importantly, what it structurally can’t. What an SBOM Genuinely Solves An SBOM’s … Read more
Organizations preparing for a first SOC 2 audit consistently underestimate one thing: not the technical controls themselves, which most reasonably mature companies already have in some form, but the evidence trail proving those controls operated consistently over the entire audit period. A control that exists but wasn’t documented as operating is, from an auditor’s perspective, … Read more
Organizations traditionally treated compliance verification as an annual audit event. Growing recognition that compliance posture drifts continuously between audit periods has driven adoption of continuous compliance monitoring as a necessary complement to that traditional periodic approach. Why Annual Audits Provide Only a Point-in-Time Snapshot Traditional annual audits verify compliance at a single specific point in … Read more
Organizations pursuing SOC 2 compliance encounter both Type I and Type II report options. Many organizations new to SOC 2 do not fully understand the meaningful difference between the two – a distinction that matters considerably for choosing the right compliance path and setting realistic customer expectations. What a SOC 2 Type I Report Covers … Read more
Technology vendors serving healthcare organizations face distinct HIPAA compliance obligations that differ meaningfully from compliance obligations facing the healthcare providers themselves, and vendors new to the healthcare space often underestimate what actual HIPAA compliance as a business associate requires. Understanding the Business Associate Relationship Technology vendors handling protected health information on behalf of a healthcare … Read more
Organizations pursuing ISO 27001 certification for the first time often have a vague understanding of what the actual certification process involves beyond a general awareness that it demonstrates real information security management maturity. Understanding the actual process helps organizations prepare more realistically and avoid common, avoidable certification delays. What ISO 27001 Actually Certifies ISO 27001 … Read more
Bring your own device policies, letting employees use personal smartphones and laptops for work purposes, offer convenience and cost savings. They also introduce security risk. Organizations need to manage that risk through thoughtful policy design instead of reaching for either extreme – banning personal devices outright, or permitting them with no security guardrails at all. … Read more
Cyber insurance has become standard practice for many businesses, but policyholders are often surprised to discover that cyber insurance carries real, specific security requirements they must maintain to keep coverage valid – requirements that go well beyond simply paying the actual policy premium itself. Why Cyber Insurers Require Specific Security Controls Cyber insurers have learned, … Read more
Software Bill of Materials requirements have moved from a niche security practice to an increasingly common regulatory and contractual requirement, particularly for organizations selling software to government agencies or operating in regulated industries. Understanding what a SBOM is, and what value it provides, matters for organizations navigating these emerging, increasingly common requirements. What a SBOM … Read more
PCI DSS compliance is mandatory for any business handling payment card data, but the specific requirements and their real practical implementation can feel overwhelming for e-commerce businesses navigating this for the very first time. Understanding the actual core requirements and, importantly, what scoped compliance looks like helps demystify a process that often feels considerably more … Read more