Category
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
Compliance work is where many growing companies discover that security expectations have already arrived, whether the business feels ready or not. A customer questionnaire, cyber insurance renewal, investor diligence request, or a sales opportunity tied to SOC 2 can all force the issue at once. This category is built for that moment.
Filter and sort
Featured article
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
Articles
A plain-English vendor risk guide for small and midsize businesses covering how to classify suppliers, what to ask software vendors before purchase.
A plain-English guide to using the free HHS and ASTP/ONC Security Risk Assessment Tool for HIPAA Security Rule work, including what the tool does well.
The 10 security controls cyber insurers actually score in 2026 — what carriers ask, what passes, and the quiet answers that get applications declined.
What cyber insurance for CPA and tax firms actually covers in 2026, the underwriting questionnaire controls carriers review.
FAQ
No. The content explains security and compliance implementation from a hands-on operator perspective, not legal counsel.
Most articles are written for SMB operators, IT leads, and security owners who need audit-ready security without building a large internal compliance team.
Yes. Obsidian Ridge focuses on the overlaps and implementation realities across NIST, ISO 27001, PCI-DSS, HIPAA, and related obligations.
The 22 cyber-insurance underwriting controls carriers ask about in 2026 — what each one asks, why carriers care.
A scenario walkthrough of a DSO with multiple M365 tenants and no central detection, brought to consolidated identity coverage in four quarters.
What IRS Publication 4557 and the FTC Safeguards Rule actually require of CPA firms in 2026 — the safeguards, the written program, and where firms slip.
What an IRS Publication 4557-aligned Written Information Security Plan (WISP) actually has to contain for a small CPA firm in 2026.
What ABA Model Rule 1.6, Formal Opinion 477R, and Formal Opinion 483 actually require of law firms in 2026.
What dental cyber insurance actually covers in 2026, the underwriting questionnaire controls carriers review.
