HIPAA
What is a Business Associate Agreement (BAA)?
A BAA is the contract HIPAA requires before a vendor touches PHI. Here is what it must contain and who needs one.
From the compliance team
Guides on getting, and staying, audit-ready
What auditors actually check, how long each framework takes, what it costs, and how to run a programme after the certificate. Written by the people who run Certifyi engagements, updated as the frameworks change.
Showing 37 to 46 of 46 articles
-
-
HIPAA
HIPAA compliance for health-tech startups: what actually matters
HIPAA has no certification. Here is what the safeguards require, when you need a BAA, and how to build a defensible position.
-
AI Governance
How to build an AI system inventory that survives an audit
Every AI governance framework starts with an inventory. Here is how to build one that is complete, current and defensible.
-
AI Governance
NIST AI Risk Management Framework, explained
NIST AI RMF is a voluntary framework built on four functions. Here is how each works and how it fits alongside ISO 42001.
-
AI Governance
The EU AI Act, explained for product and engineering teams
The EU AI Act classifies AI systems by risk and attaches obligations to each tier. Here is what it means for your roadmap.
-
ISO 27001
The ISO 27001 Statement of Applicability, explained
The SoA is the document auditors scrutinise hardest. Here is what it must contain, how to justify exclusions, and the mistakes that fail Stage…
-
ISO 27001
ISO 27001 vs SOC 2: which should you do first?
The honest answer depends on where your buyers are. Here is how to choose, and how to avoid paying twice when you eventually need…
-
SOC 2
SOC 2 Trust Service Criteria explained (and which to include)
Security, Availability, Confidentiality, Processing Integrity and Privacy. What each criterion covers and how to decide which belong in your scope.
-
SOC 2
How much does SOC 2 cost in 2026? A full breakdown
SOC 2 costs more than the platform fee. Here is the real budget: software, auditor, pen test, remediation and internal time, with 2026 ranges.
-
SOC 2
SOC 2 Type 1 vs Type 2: which one do you actually need?
Type 1 proves controls are designed well at a point in time. Type 2 proves they operated over months. Here is how to choose…
Have a question the guides do not answer?
Ask the person who would run your programme. Twenty minutes, no slides.