Evidence library
Analysis of the gaps between stated controls and the data movement Melurna observes.
Explore the blog
Vendor risk monitoring tracks each vendor’s risk indicators throughout the relationship so you can confirm its controls still hold. When something changes (a breach, data loss, financial deterioration, […]
State privacy law supersedes HIPAA (Health Insurance Portability and Accountability Act) when a state provision conflicts with the HIPAA Privacy Rule (HIPAA’s core health-privacy regulation, 45 CFR Part […]
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customers’ private information and explain how they share it. This U.S. federal law, passed on November 12, 1999 (Pub. […]
Fourth-party risk is the exposure your organization carries from the companies your vendors rely on: the sub-processors behind your processors, the infrastructure under your SaaS tools, and the […]
PHI, or protected health information, means any health information that can identify a person and is held or sent by a covered entity or business associate under the […]
Google says it “makes no representations that Google Analytics satisfies HIPAA requirements,” offers no business associate agreement for it, and advises HIPAA-regulated customers to “refrain from exposing to […]
Quick response by shared and managed hosting providers has led to a sharp jump in patched sites. On Wednesday, PHP.net shipped an emergency fix for two critical, remotely […]
On October 21, 2026, the PHP project shipped an emergency fix for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). We analyzed 6.7M of the world’s most-visited PHP sites to […]
In California, the Confidentiality of Medical Information Act (CMIA), Civil Code §§ 56–56.37, prohibits health care providers, health plans, contractors, and pharmaceutical companies from disclosing individually identifiable medical […]
Third party privacy risk management is the discipline of knowing which outside parties handle personal data you are responsible for, understanding what they do with it, and being […]
