Scarlet Risk · Learn
Compliance 101
Plain-English explainers on SOC 2, HIPAA, CMMC, PCI, and how to tell which frameworks apply to you.
Separate legal obligations from buyer expectations
A compliance conversation can begin with a law, a contract, an insurer, or a customer’s procurement process. These are not interchangeable. Start by recording who requires the evidence, which activity or information is involved, and what the actual requirement says. A broad industry label rarely supplies enough detail for a final determination.
SOC 2 produces an attestation report, while ISO 27001 certification addresses a defined information security management system. HIPAA obligations depend on covered-entity and business-associate relationships. PCI DSS scope depends on the payment environment. CMMC depends on the applicable defense contract and information boundary.
Define scope before buying or generating documents
List the services, locations, users, data flows, and providers that support the activity under review. Ask whether the requirement covers one product, an enclave, or the wider business. Select the relevant standard revision and assessment route before adopting a checklist; similarly named requirements can have different evidence and assessment rules.
- Keep the customer request, contractual requirement, or official guidance that prompted the review.
- Identify a business owner and the systems in scope.
- Map existing controls to evidence and record unresolved gaps.
- Confirm formal assessment requirements with the appropriate qualified professional.
Read readiness results as a starting point
A short questionnaire can help decide what to investigate, not whether an organization has passed an audit. Separate self-reported answers from verified evidence and an independent assessment. Avoid describing a generated policy as an implemented safeguard until it has been approved, put into operation, and supported by records.
Several frameworks may overlap without being equivalent. Reuse relevant evidence where appropriate, but check scope and assessment expectations rather than assuming work for one framework satisfies another. General learning material is not a substitute for advice about specific legal or contractual obligations.