by Assurion Services | Oct 5, 2026 | Security Testing
The AICPA trust services criteria do not require a penetration test. The words do not appear as a mandate anywhere in the criteria themselves. Yet almost every SOC 2 report you will ever read includes a pen test control, and almost every auditor will ask for the...
by Assurion Services | Oct 5, 2026 | HIPAA
The short version: “adequate” means accurate and thorough, covering all electronic protected health information your organisation creates, receives, maintains or transmits — everywhere it lives, not just in the obvious system. The Security Rule uses that...
by Assurion Services | Oct 5, 2026 | HIPAA
Start with the fact that explains the whole situation: there is no such thing as HIPAA certification. No government body certifies compliance, and no private firm can confer a status that the regulator does not recognise. Anyone selling you a HIPAA certificate is...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
When an auditor tests your user access review, they are not checking that a review happened. They are checking three things: that someone looked at a complete list of who has access to what, that the person looking had the standing to say “this person should not...
by Assurion Services | Oct 5, 2026 | Compliance Readiness
Auditors are not testing whether you have a change process. Everyone has one. They are testing whether anything reached production without going through it, and whether the changes that did go through it were authorised, tested and approved by someone other than the...
