Obsidian RidgeCategory
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
Compliance work is where many growing companies discover that security expectations have already arrived, whether the business feels ready or not. A customer questionnaire, cyber insurance renewal, investor diligence request, or a sales opportunity tied to SOC 2 can all force the issue at once. This category is built for that moment.
Filter and sort
Featured article
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
Articles
Which cybersecurity rules a solo or two-person advisory firm answers to: Regulation S-P, Regulation S-ID, state rules and the FTC Safeguards Rule.
A copyable staff AI policy, plus browser and device controls to manage client data, approved tools and incident reporting.
Nine checks for a dental security provider: devices, accounts, HIPAA responsibilities, response, evidence, backups and the full price.
What a tax practice should put in its WISP, the evidence to retain and the FTC notification rule, with IRS and FTC sources.
A three-attorney cost example, ABA duties, provider questions and the evidence a small law firm should ask for.
Six MDR options for a dental practice, compared on what each vendor publishes: HIPAA fit, identity coverage, price, term, seat minimum, who responds.
Every question on Travelers' Multi-Factor Authentication Supplement (CYB-14306), what a true Yes takes, and the evidence to have ready before you sign.
Who signs a cyber insurance application, what the signature represents, and why the signer must check the security answers with IT first.
What the SIG Lite questionnaire is, who sends it, how it differs from SIG Core, and how a small business answers it honestly without a security team.
Filing season concentrates the exposure. What IT covers, what a security operation covers, and the reporting path the IRS walks after a preparer breach.
FAQ
No. The content explains security and compliance implementation from a hands-on operator perspective, not legal counsel.
Most articles are written for SMB operators, IT leads, and security owners who need audit-ready security without building a large internal compliance team.
Yes. Obsidian Ridge focuses on the overlaps and implementation realities across NIST, ISO 27001, PCI-DSS, HIPAA, and related obligations.