Tag: compliance

Set up thorough request/response logging and audit trails for APIs with structured output, correlation IDs, and compliance considerations.

Implement data privacy controls, consent management, data anonymization, and GDPR-compliant data handling in web applications.

How to encrypt sensitive data before storing it in databases, object storage, and backups using AES-256-GCM, envelope encryption, and key management services.

A template for data classification, retention, access control, privacy, and compliance policies covering GDPR, CCPA, and SOC 2 requirements.

A template for auditing user access rights, verifying least privilege, and documenting access decisions across systems and teams.

A template for mapping current security controls to compliance frameworks like SOC 2, ISO 27001, and PCI-DSS.

A baseline template for hardening container images, runtimes, and orchestration configurations across environments.

A step-by-step playbook for responding to security incidents involving unauthorized data access, from initial detection through notification and remediation.

A template to define how long data is kept, when it is archived, and when it must be deleted for compliance and cost reasons.

A template for planning and executing disaster recovery tests including failover validation, data integrity checks, and recovery time measurement.

A template for managing the creation, distribution, rotation, and destruction of encryption keys across applications and services.

A checklist template for hardening laptops, workstations, and mobile devices that access corporate data and systems.

A template for documenting network security zones, segmentation rules, and traffic controls between environments and tenants.

A template for defining the boundaries, targets, rules, and deliverables for a penetration testing engagement.

A template for tracking and scheduling the rotation of API keys, passwords, certificates, and other secrets across systems.

A structured template for evaluating the security, compliance, and operational posture of third-party vendors before onboarding or renewal.

A template for reviewing and certifying user access rights across systems, applications, and data repositories.

A template for summarizing vulnerability scan findings, including asset coverage, severity distribution, and remediation tracking.

A WCAG 2.2 compliance checklist covering perceivable, operable, understandable, and robust criteria with testing tools and remediation steps.

A template for classifying data as public, internal, confidential, or restricted with handling rules.

A step-by-step playbook template for handling security incidents.

Checklist for tracking OWASP Top 10 vulnerability remediation per application: risk assessment, fix priority, code-level remediation steps, verification testing, and compliance reporting with examples for each OWASP category.

A template for tracking security findings, assigning remediation owners, and validating fixes after penetration tests.

A checklist for security audits covering network security, application security, data protection, access control, monitoring, incident response, and compliance.

A thorough checklist for conducting security audits of applications and infrastructure.

A template for evaluating third-party vendor security and operational risks.

A repeatable template for tracking vulnerabilities, assigning remediation owners, defining patching timelines, and reporting security risks to stakeholders.

Security hardening checklist for serverless functions: IAM least privilege, secret management, input validation, dependency scanning, network isolation, logging, and compliance with code examples for AWS Lambda, Azure, and GCP.

A developer-focused guide to GDPR compliance: data subject rights, lawful basis, data minimization, and technical measures for privacy by design.

A practical guide to SOC 2 Type II for developers: Trust Service Criteria, evidence collection, and building compliant systems from day one.