Obsidian RidgeCategory
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
Compliance work is where many growing companies discover that security expectations have already arrived, whether the business feels ready or not. A customer questionnaire, cyber insurance renewal, investor diligence request, or a sales opportunity tied to SOC 2 can all force the issue at once. This category is built for that moment.
Filter and sort
Featured article
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
Articles
Decide how AI meeting notes are reviewed, retained and retrieved at an RIA, with SEC Regulation S-P dates and a checklist for the compliance officer.
Decide which AI notetakers may join client calls, what to tell clients and what to verify, using ABA Opinion 512 and a practical approval checklist.
Before an AI scribe receives patient audio, confirm its agreement, plan and features. A vendor checklist for dental and medical practices.
Put the AI tools your CPA firm actually uses in its WISP, with IRS Publication 5708, FTC guidance and a practical inventory and approval checklist.
Stop client data reaching unapproved AI tools with approved accounts and tested controls. Obsidian Ridge explains how to put an AI policy into practice.
For a solo or two-person advisory firm: which cybersecurity rules you answer to under Regulation S-P, S-ID, state rules and the FTC Safeguards Rule.
How law firms and dental offices can stop staff pasting client data into ChatGPT, with policy and managed browser controls from Obsidian Ridge.
Obsidian Ridge's dental cyber-insurance renewal checklist covers devices, accounts, response, evidence, backups and truthful questionnaire answers.
CPA cybersecurity for an IRS WISP and FTC Safeguards: Obsidian Ridge explains controls, evidence and responsibilities with IRS and FTC sources.
A three-attorney cost example from Obsidian Ridge, ABA duties, provider questions and the evidence a small law firm should ask for.
FAQ
No. The content explains security and compliance implementation from a hands-on operator perspective, not legal counsel.
Most articles are written for SMB operators, IT leads, and security owners who need audit-ready security without building a large internal compliance team.
Yes. Obsidian Ridge focuses on the overlaps and implementation realities across NIST, ISO 27001, PCI-DSS, HIPAA, and related obligations.