One post per framework. Each one pairs a step-by-step walkthrough with illustrative data and an explainer of the queries behind it.
An Article 15 request asks for the personal data you hold, its sources and its recipients. This post shows the queries that collect it from recorded history.
California's twelve-month sharing lookback is hard to evidence from current-state data. This post shows the queries that read it from recorded history.
NAIC market-conduct examinations are six-week projects for most carriers. This post shows the queries that answer the examiner's three questions.
An HHS OCR complaint about a documented clinical override is a question your audit chain should already have answered.
An Annex IV documentation package is expensive to assemble after the fact. If the evidence is recorded as the work happens, queries can return it as it stood at deployment.
AS-1105 evidence integrity is a sentence in the standard. With a hash-chained history log, it is one check you can run.
Requirement 10 asks who accessed cardholder data and when. This post shows the queries that read that access history from one recorded graph.
Article 19 sets a four-hour initial notification. This post shows the queries that trace which services and customers an ICT incident affects.
Much of a HITRUST assessment is evidence reconciliation. This post shows how control evidence recorded in one history can be queried per control.
Section 500.17 sets a 72-hour notice to the Superintendent. This post shows the queries that build the incident timeline from recorded history.
The FDA inspector wants the audit trail for batch B-44218 as it stood at lot release. This post shows the queries that return it from recorded history.
A NERC CIP audit asks for evidence asset by asset. This post shows the queries that return each asset's recorded configuration and changes.
FedRAMP continuous monitoring asks for evidence control by control. This post shows the queries that return it from recorded history.
The hardest FINRA question — has the model card been edited since the trade? — is the easiest one to answer if your records are chained.