Prowler has HIPAA checks. What checklist-based compliance still misses.
✓ Human-authored analysis; AI used for formatting and proofreading. The 2018 conversation In Prowler issue #227 , a user asked: "any plan to add [HI…
Последние новости
⚑ Сообщить о проблемеTech news from the best sources
Все темы
- игры
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
CPCSC for security integrators: what changes
Most integrators file CPCSC under “the client’s problem.” The defense supplier gets certified, the crew installs the cameras and card readers, and s…
A date is not a version: strict parsing under OSV ranges
A vulnerability range is a claim about ordering, and it is worth no more than the version parser sitting underneath it. Walk an OSV range's events i…
Labelling AI-written articles and synthetic media under Article 50
This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general informatio…
SMS Alert API Alternatives Explained (Europe GDPR and US Startup Support)
Choose an SMS alert API by the evidence it lets your system retain, not by the apparent simplicity of its send call. For US and EU loan-application…
The 44% Problem
October 15, 2026 The report says AI was involved in 84% of ransomware attacks. That number is being repeated everywhere today. It is not the importa…
One NCR form to rule them all stopped working the day we added our 30th supplier
Last month, a buyer pinged me: "Why is this incoming-inspection NCR asking me whether the customer filed a complaint?" Fair question. It's because w…
Medical record anonymization
Short answer Under Brazil’s LGPD (Lei Geral de Proteção de Dados), medical record anonymization is a lawful means to process health data without con…
Node.js Email Service: Auditing Deliverability, Template Testing, Preview, and Domain Auth
A compliance notice changes the email-service decision because a pleasant template editor and a provider-level "delivered" status are not an audit r…
21 CFR Part 11 is where 'approve by email' shops quietly fail — a typed name is not a signature
The CAPA that taught me what an email isn't Two years ago I inherited a CAPA queue that included a finding from our prior notified body audit. The w…
OAB Recommendation 001/2024
Short answer OAB Recommendation 001/2024 is a non-binding guidance issued by the Brazilian Bar Association (Ordem dos Advogados do Brasil) on 12 Mar…
The guardrail receipt
Short answer A guardrail receipt is a tamper-evident audit record proving that an AI guardrail evaluation occurred with a defined policy, input scop…
How to write a security.txt (RFC 9116), and why EU software makers now need one
A security.txt file tells security researchers how to reach you when they find a vulnerability. It is a plain text file at /.well-known/security.txt…
PII: CPF and CNPJ masking
Short answer CPF and CNPJ must be masked in non-production AI systems and logs under LGPD’s principle of data minimisation (Art. 6, III) and confide…
What EU AI Act Article 12 and ISO 42001 mean for AI agent logs
Article 12 of the EU AI Act says high-risk AI systems must technically allow automatic recording of events (logs) over the lifetime of the system. I…
5 Public-Record Checks for KYB Entity Verification
Know Your Business (KYB) starts with a boring question: does this company actually exist, and is it in good standing? Most onboarding flows still tr…
The people an accessibility overlay is for rate it worse than everybody else
The pitch is close to irresistible. One line of JavaScript, no engineering work, no audit, and a legal problem becomes a subscription line item. If…
Закрыли все CVE и оставили admin:admin: зачем VM-специалисту комплаенс
Можно закрыть все уязвимости и быть взломанным через стандартный пароль. Разбираем, что такое комплаенс в ИБ, почему в России он стал жестче и дорож…
Закрыли все CVE и оставили admin:admin: зачем VM-специалисту комплаенс
Можно закрыть все уязвимости и быть взломанным через стандартный пароль. Разбираем, что такое комплаенс в ИБ, почему в России он стал жестче и дорож…
How to Isolate 3 Unattended Key Inventory Review Jobs
Run the credential inventory as an unattended, read-only control, then archive a dated and integrity-protected review document outside the event ing…
Auth Provider Event History vs. Your Audit Log: SOC 2 Evidence
A customer-support system cannot treat an identity provider's event history as the complete record of a risky login. The provider can record authent…
Compliance Evidence Under Load: 500 Local or Hosted PDF API Jobs at Scale
Short answer: use a hosted PDF API when a small team needs repeatable form filling across bursty workers and can accept a measured network hop; keep…
The EU Cyber Resilience Act Reporting Duty Started on 11 September 2026: What Manufacturers Now Have to Do in 24 Hours
The EU Cyber Resilience Act Reporting Duty Started on 11 September 2026: What Manufacturers Now Have to Do in 24 Hours On 11 September 2026, Article…
The EU AI Act's logging rule moved to December 2027. The logs did not get easier.
The Digital Omnibus on AI (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and entered into force three days later.…
The AI approval boundary nobody talks about until the audit finds it
The first time I saw an AI approve a CAPA closure, I'll admit I paused. Not because the decision was wrong — it wasn't — but because I couldn't find…
Когда всё соответствует требованиям, но защищенности больше не становится: про ловушки формального контроля
Я наблюдал ситуации, когда компания формально соответствует требованиям регулятора, регулярно проходит аудиты, имеет утвержденные Политики, настроен…
Everyone agrees on the risk. They disagree on the price.
Published 2026-09-06 Every regulatory claim here was read from the primary document on that date, and each is cited in the policy sources . Guidance…
Не конкурируй с ИИ — управляй им. Как специалисту по ИБ остаться востребованным в эпоху ИИ-агентов
Привет, Хабр! Меня зовут Алексей Лукацкий, я бизнес-консультант по безопасности и Chief Evangelist Officer в Positive Technologies, а до этого больш…
Begin with control; the real win is turning it into daily practice
To be fair, "we have a QMS" is the easiest checkbox in a notified‑body audit. The hard part is that regulators, auditors and — most importantly — fr…
Help wanted: validate a React retention and records review SPFx sample
Help wanted: validate a React retention and records review SPFx sample A new read-only React sample is ready for the PnP SharePoint Framework webpar…