Obsidian RidgeCategory
SOC 2, HIPAA, CMMC, PCI-DSS, ISO 27001, audit prep, and control mapping for growing teams.
Compliance work is where many growing companies discover that security expectations have already arrived, whether the business feels ready or not. A customer questionnaire, cyber insurance renewal, investor diligence request, or a sales opportunity tied to SOC 2 can all force the issue at once. This category is built for that moment.
Filter and sort
Featured article
A practical walkthrough of cyber insurance for first-time SMB buyers in 2026 — what the policy covers, what the questionnaire asks.
Articles
A plain-English guide for defense contractors on how the NIST SP 800-171 self-assessment score works, what SPRS actually stores.
A plain-English guide to North Carolina's data breach notification law for small businesses, including who must notify, what the notice must say.
A plain-English PCI DSS 4.0.1 guide for small merchants covering how to choose the right SAQ, what changed in the v4.0.1 SAQ set.
A plain-English vendor risk guide for small and midsize businesses covering how to classify suppliers, what to ask software vendors before purchase.
A plain-English guide to using the free HHS and ASTP/ONC Security Risk Assessment Tool for HIPAA Security Rule work, including what the tool does well.
The 10 security controls cyber insurers actually score in 2026 — what carriers ask, what passes, and the quiet answers that get applications declined.
What cyber insurance for CPA and tax firms actually covers in 2026, the underwriting questionnaire controls carriers review.
The 22 controls cyber insurers verify in 2026: what each application question asks, why underwriters care, and the evidence behind a yes.
A scenario walkthrough of a DSO with multiple M365 tenants and no central detection, brought to consolidated identity coverage in four quarters.
What IRS Publication 4557 and the FTC Safeguards Rule actually require of CPA firms in 2026 — the safeguards, the written program, and where firms slip.
FAQ
No. The content explains security and compliance implementation from a hands-on operator perspective, not legal counsel.
Most articles are written for SMB operators, IT leads, and security owners who need audit-ready security without building a large internal compliance team.
Yes. Obsidian Ridge focuses on the overlaps and implementation realities across NIST, ISO 27001, PCI-DSS, HIPAA, and related obligations.