Category
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
Compliance work is where many growing companies discover that security expectations have already arrived, whether the business feels ready or not. A customer questionnaire, cyber insurance renewal, investor diligence request, or a sales opportunity tied to SOC 2 can all force the issue at once. This category is built for that moment.
Filter and sort
Featured article
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks, the controls carriers review, and how to pass the application without overspending.
Articles
Property managers hold tenant SSNs and bank details, pull credit reports under FCRA, and move owner money — making them a prime target for wire fraud and data theft. The real exposures and the controls that close them.
Skilled nursing and home health are HIPAA covered entities; assisted living often handles PHI too. What senior-care operators must protect, the proposed Security Rule changes, and the controls that keep residents and revenue safe.
If you take card payments — in a shop or online — PCI DSS applies to you, and 51 new v4.x requirements became mandatory in 2025. What that means for a small merchant, plain-English, without the jargon.
Closing-wire fraud is the most expensive cyberattack in real estate — and most title and settlement firms don't realize the FTC Safeguards Rule already treats them as financial institutions. Here's the exposure and the fix.
FAQ
No. The content explains security and compliance implementation from a hands-on operator perspective, not legal counsel.
Most articles are written for SMB operators, IT leads, and security owners who need audit-ready security without building a large internal compliance team.
Yes. Obsidian Ridge focuses on the overlaps and implementation realities across NIST, ISO 27001, PCI-DSS, HIPAA, and related obligations.
No — HIPAA doesn't cover pets, and there's no federal law requiring vets to safeguard animal health records. But veterinary practices still run on payment data and cloud software that ransomware loves. The real risk, and what to do about it.
A plain-English CMMC guide for small defense contractors covering what Level 2 means in 2026, what actually drives cost, how the rollout works, and the steps to get ready.
A plain-English guide for defense contractors on how the NIST SP 800-171 self-assessment score works, what SPRS actually stores, and how to close the gaps that keep the score low.
A plain-English guide to North Carolina's data breach notification law for small businesses, including who must notify, what the notice must say, when to contact the Attorney General, and when consumer reporting agencies must be told.
A plain-English PCI DSS 4.0.1 guide for small merchants covering how to choose the right SAQ, what changed in the v4.0.1 SAQ set, and where merchants usually scope themselves wrong.
A plain-English vendor risk guide for small and midsize businesses covering how to classify suppliers, what to ask software vendors before purchase, which contract points matter, and how to avoid treating every third party like the same level of risk.
