.webp?width=2169&height=526&name=Compass%20regular%20transparent%20website%20(1).webp "Compass IT Compliance Logo")
-1.webp?width=2169&height=620&name=Compass%20regular%20transparent%20website%20smaller%20(1)-1.webp "Compass IT Compliance")
CISA's K-12 Cybersecurity Guidance: A Roadmap for School Districts
by Kyle Daun on August 24, 2026 at 1:21 PM
On August 12, CISA released the K-12 Cybersecurity Foundations Resource Package, which is a Getting Started Guide, an Implementation Guide, a six-part video series, and quick-reference materials built around eight core objectives: credential protection, device and asset security, back …
What Is a PCI DSS Gap Analysis & What Should You Expect to Find?
by Patrick Hughes on August 20, 2026 at 1:00 PM
Before an organization commits to a full PCI DSS assessment, most experienced QSAs recommend starting with a gap analysis. It is a lower-pressure, exploratory step that tells you where you actually stand before the clock starts on a formal engagement. Here is what a PCI gap analysis i …
What Drives SOC 2 Audit Cost: 5 Factors to Know Before You Budget
by Rachel Hughes on August 17, 2026 at 1:15 PM
If a SOC 2 audit quote made you raise an eyebrow, you're not alone. Prices vary widely from firm to firm, sometimes for the same size company in the same industry, and it's easy to assume someone is either overcharging or cutting corners. But before you go shopping for the lowest numb …
Breaching a Water Treatment Facility: A Physical Security Test
by Patrick Laverty on August 12, 2026 at 9:56 AM
Most water utilities invest heavily in network penetration testing and web application security, and rightly so. Far fewer test whether someone can simply walk onto the property, badge their way past staff, or climb a fence after dark and reach the equipment that keeps water flowing t …
Do You Need a QSA? How to Choose the Right Assessor for Your Firm
by Patrick Hughes on August 11, 2026 at 12:15 PM
If your business stores, processes, or transmits cardholder data, you have almost certainly come across the term QSA. But whether you actually need to hire one, and how to pick a good one if you do, is not always clear. This guide breaks down what a Qualified Security Assessor does, w …
What the Minnesota Water Hack Reveals About OT Security Assessments
by Jesse Roberts on August 5, 2026 at 11:00 AM
On July 26 and 27, a coordinated cyberattack hit more than 30 community water systems across Minnesota. Our team is trained in running penetration tests against OT and ICS environments, and when we read the reporting on this one, nothing about it was surprising. That's the part that s …