LakeRidge Blog

Compliance guides, checklists & news

Practical, control-by-control guidance for CMMC, NIST SP 800-171, HIPAA, ISO 27001 and NCA ECC — written by the team that gets companies certified.

NIST SP 800-171 & CMMC Level 2 CMMC Level 1 & FAR 52.204-21 NCA ECC (Saudi Arabia) HIPAA ISO 27001 Cybersecurity & Compliance

Cybersecurity ·Jul 2026

What Should a USB Drive Policy Template Include?

A usb drive policy template should define approved devices, access rules, encryption, transport, disposal, exceptions, and review requirements.

Cybersecurity ·Jul 2026

What Should a Microsoft 365 Tabletop Exercise Test? (2-7-3)

Learn what to test in a microsoft 365 tabletop exercise, including data handling decisions, incident actions, owners, and evidence.

HIPAA ·Jul 2026

What Security Policies Does a Dental Office Need First? (2 Hours)

Use this dental office security policies checklist to document the first HIPAA Security Rule policies in two focused hours.

Cybersecurity ·Jul 2026

What Office Security KPIs Should You Track in BigQuery?

Track office security kpis BigQuery metrics for access reviews, visitor records, facility issues, and evidence of ISO 27001 control performance.

Cybersecurity ·Jul 2026

What Is a Logging RACI Matrix for IT, HR, Legal and Leadership?

Define logging raci matrix roles so IT, HR, Legal, security, and leaders can assign ownership for producing, protecting, and reviewing logs.

HIPAA ·Jul 2026

What Is a Business Associate Agreement for a Cloud Backup Vendor?

Learn when a business associate agreement cloud backup vendor is required, what HIPAA terms it needs, and what proof buyers expect.

Cybersecurity ·Jul 2026

What Is a 30-Day Plan to Fix Missing App Security Requirements? (1-6-3)

Use this 30 day plan for application security requirements to document controls, test applications, harden releases, and produce ECC 1-6-3 evidence.

Cybersecurity ·Jul 2026

What GitHub Reports Prove Source Code Access Is Controlled?

github reports source code access audit evidence shows who can access repositories, what permissions they hold, and how access changes are reviewed.

HIPAA ·Jul 2026

What Evidence Do Auditors Need From SharePoint Version History?

SharePoint version history audit evidence shows auditors who changed ePHI, when prior copies were preserved, and how integrity controls are tested.

HIPAA ·Jul 2026

What Does Workstation Security Cost Per Clinic?

The workstation security cost per clinic typically runs $500–$1,100 per worker in year one; see a 50-person budget, ROI, and breakeven math.

Cybersecurity ·Jul 2026

What Does Compliant Scanning Look Like in Microsoft Defender? (SI.L2-3.14.5)

See how cmmc microsoft defender compliant file scanning meets SI.L2-3.14.5 with defined periodic scans and real-time external-file protection.

Cybersecurity ·Jul 2026

What Do Background Checks Cost per Employee? (PS.L2-3.9.1)

Estimate background check cost per employee CMMC at $95–$200 in year one, then calculate the budget, avoided-loss ROI, and buy-versus-build threshold.

Cybersecurity ·Jul 2026

What Counts as a Reportable Phishing Incident? (IR.L2-3.6.2)

Define a cmmc reportable phishing incident and show how to track, document, and notify the right people for CMMC Level 2.

Cybersecurity ·Jul 2026

What Contract Clauses Require 24-Hour Incident Reports?

Use contract clauses for 24-hour incident reporting to bind vendors and subcontractors to fast notice, evidence preservation, and audit rights.

Cybersecurity ·Jul 2026

What Clear Desk KPIs Should IT Managers Track Monthly?

Use clear desk kpis to track monthly to prove ISO 27001 clear desk and clear screen enforcement with audit-ready evidence and trends.

HIPAA ·Jul 2026

What Clauses Require Annual Subcontractor Security Reviews?

Use a hipaa annual subcontractor security review clause to require documented yearly reviews, evidence, audit access, and remediation rights.

HIPAA ·Jul 2026

What Are the Minimum Identity Checks for Health Records? 2-Hour Baseline

Establish minimum identity checks for health records in two hours with HIPAA §164.312(d) evidence an auditor can test.

HIPAA ·Jul 2026

What Are Patient Data Email Requirements in Microsoft 365?

Understand hipaa email requirements microsoft 365: secure patient data in transit, apply encryption when appropriate, and document safeguards.

Cybersecurity ·Jul 2026

What a Payroll Fraud Postmortem Taught Us About Dual Approval

A payroll fraud dual approval postmortem shows why independent review, separated permissions, and audit evidence stop payment diversion.

Cybersecurity ·Jul 2026

Using Azure Key Vault HSM for High-Sensitivity Data (2-8-3)

Azure Key Vault Managed HSM configuration secures high-sensitivity keys with HSM-backed generation, rotation, access control, and ECC 2-8-3 evidence.

Cybersecurity ·Jul 2026

Ultimate Guide to CUI Subcontractor Transfers (AC.L2-3.1.3)

Meet CUI subcontractor transfer requirements by authorizing, encrypting, documenting, and enforcing every approved CUI data flow.

HIPAA ·Jul 2026

The Ultimate Guide to ePHI Workstation Security (164.310(c))

Understand hipaa workstation security requirements under 164.310(c), with remote-work safeguards, implementation steps, a checklist, and FAQs.

Cybersecurity ·Jul 2026

SIEM vs IDS: Which Does a Small Business Need First?

siem vs ids for small business: start with a managed SIEM for broad monitoring, then add IDS when network-specific detection is needed.

Cybersecurity ·Jul 2026

Security Alert vs Incident: Close Defender False Positives (IR.L2-3.6.2)

Understand microsoft defender alert vs incident: close benign Defender detections, document true incidents, and meet CMMC IR.L2-3.6.2 reporting.

Cybersecurity ·Jul 2026

Rippling vs BambooHR for Disciplinary Cases: Pricing by Size

Rippling vs BambooHR disciplinary case pricing by company size: compare costs, audit evidence, and the best ISO 27001 fit.

Cybersecurity ·Jul 2026

PowerShell Script Policy Template for IT Teams (SC.L2-3.13.13)

Use this powershell script policy template to authorize, restrict, monitor, and document PowerShell use for CMMC Level 2 assessments.

HIPAA ·Jul 2026

OneTrust vs LogicGate for vendor breaches: pricing tiers & size fit

Compare onetrust vs logicgate vendor breach pricing tiers, size fit, and evidence workflows for HIPAA business-associate breach response.

Cybersecurity ·Jul 2026

How to Turn an Excel Asset List Into a Compliant Register

A practical ISO 27001 playbook to migrate excel asset list to compliant asset register, assign owners, preserve evidence, and validate control 5.9.

HIPAA ·Jul 2026

How to Set ChromeOS Screen Lock: Devices > Chrome > Settings

Learn how to set ChromeOS screen lock Google Admin console settings to require timely locking and password-protected access on managed devices.

HIPAA ·Jul 2026

How to Run a Tabletop Exercise for a Stolen EHR Badge

Run a stolen EHR badge tabletop exercise to test identity verification, revoke access, preserve evidence, and improve HIPAA response decisions.

Cybersecurity ·Jul 2026

How to Move from Ad Hoc Offboarding to a 30-Day Exit Plan

Learn how to create a 30 day employee exit plan with a practical migration path, cutover runbook, evidence, and ISO 27001 controls.

Cybersecurity ·Jul 2026

How to Monitor Outsourced Developers: Azure Monitor > Activity Log

Use azure monitor outsourced developers activity log to export, alert on, and retain contractor Azure changes for ISO 27001 8.30 evidence.

HIPAA ·Jul 2026

How to Fix Shared Dentrix Logins After an Audit Finding

Learn how to fix shared Dentrix logins audit finding with unique accounts, access cleanup, evidence, and repeatable HIPAA controls.

HIPAA ·Jul 2026

How to Fix Overbroad Google Cloud IAM Roles After an Audit

Learn how to fix overbroad google cloud iam roles audit finding with scoped replacements, validation evidence, and repeatable review controls.

Cybersecurity ·Jul 2026

How to Build a Google Workspace Mobile Device Compliance Dashboard (AC.L2-3.1.18)

Build a Google Workspace mobile device compliance dashboard with KPI targets, data sources, and reporting evidence for CMMC AC.L2-3.1.18.

Cybersecurity ·Jul 2026

How to Automate Entra Named Locations with PowerShell (2-5-3)

Learn how to automate entra named locations powershell with idempotent Microsoft Graph scripts, approvals, logging, and rollback controls.

Cybersecurity ·Jul 2026

Google Workspace NDA Requirements: The Ultimate Guide

Google workspace nda requirements: document, sign, review, and retain confidentiality agreements for users who access sensitive information.

Cybersecurity ·Jul 2026

Google Workspace Audit Log Timestamp Clause Template (AU.L2-3.3.7)

Use this google workspace audit log timestamp clause template to require synchronized audit timestamps from subcontractors supporting CMMC Level 2 work.