Category
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
Compliance work is where many growing companies discover that security expectations have already arrived, whether the business feels ready or not. A customer questionnaire, cyber insurance renewal, investor diligence request, or a sales opportunity tied to SOC 2 can all force the issue at once. This category is built for that moment.
Filter and sort
Featured article
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
Articles
Nonprofits face the same attacks as any business on a fraction of the budget. There's no nonprofit-specific cyber law.
Property managers hold tenant SSNs and bank details, pull credit reports under FCRA, and move owner money.
Skilled nursing and home health are HIPAA covered entities; assisted living often handles PHI too. What senior-care operators must protect.
x requirements became mandatory in 2025. What that means for a small merchant, plain-English, without the jargon.
FAQ
No. The content explains security and compliance implementation from a hands-on operator perspective, not legal counsel.
Most articles are written for SMB operators, IT leads, and security owners who need audit-ready security without building a large internal compliance team.
Yes. Obsidian Ridge focuses on the overlaps and implementation realities across NIST, ISO 27001, PCI-DSS, HIPAA, and related obligations.
Closing-wire fraud is the costliest cyberattack in real estate, and most title and settlement firms miss that the FTC Safeguards Rule already covers them.
No — HIPAA doesn't cover pets, and there's no federal law requiring vets to safeguard animal health records.
A plain-English CMMC guide for small defense contractors covering what Level 2 means in 2026, what actually drives cost, how the rollout works.
A plain-English guide for defense contractors on how the NIST SP 800-171 self-assessment score works, what SPRS actually stores.
A plain-English guide to North Carolina's data breach notification law for small businesses, including who must notify, what the notice must say.
A plain-English PCI DSS 4.0.1 guide for small merchants covering how to choose the right SAQ, what changed in the v4.0.1 SAQ set.
