Tag
SOC 2
75 articles
Compliance frameworks
Mapping HIPAA to SOC 2 controls
A working map from HIPAA Security Rule standards to SOC 2 criteria, where the two diverge, and how to run one control set that serves both obligations.
5 min read
Compliance frameworks
The policies a SOC 2 audit expects to see
The criteria never list required policies, yet auditors expect a familiar set. Which policies to write, what each must say, and how auditors test them.
6 min read
Security engineering
Cloud security posture on AWS
The AWS posture controls auditors test first: account structure, root and human access, logging, guardrails and data exposure, and the evidence each yields.
6 min read
Audit readiness
Running a mock audit
A mock audit tests whether you can produce evidence under audit conditions. Who should play the auditor, what to scope, how to run it, and how to use findings.
6 min read
Compliance frameworks
What a SOC 3 report is for
A SOC 3 is the public summary of a SOC 2 examination. What it contains, what it deliberately leaves out, where it helps sales, and where buyers still want more.
6 min read
Security engineering
Key management and rotation
How key hierarchies, separation of duties, rotation and key deletion work in a cloud KMS, what PCI DSS and ISO 27001 expect, and the evidence auditors test.
6 min read
Audit readiness
An audit readiness checklist
A working checklist for the weeks before an audit: scope, documents, owners, populations, people, vendors and logistics, with what each item must show.
6 min read
Compliance frameworks
SOC 2 vs SOC 1: which report your customers need
SOC 1 serves your customers' financial auditors. SOC 2 serves their security teams. How to tell which one a request is really for, and when you need both.
6 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Audit readiness
Assigning control owners who stay engaged
Naming a control owner takes a minute; keeping them engaged for an audit period is the real work. How to pick owners, define the role, and survive handovers.
6 min read
Compliance frameworks
What drives the cost of a SOC 2 audit
The scope decisions, evidence habits, and internal effort that set what a SOC 2 audit costs, and which of them you can change before you sign anything.
6 min read
Security engineering
Secrets management for engineering teams
Where application secrets should live, how to retire long-lived credentials, what to do in the first hour after a leak, and the evidence auditors ask for.
6 min read
Trust and sales
Security commitments in customer contracts
Where security commitments hide in customer contracts, the types you will find, why your SOC 2 report depends on them, and how to keep a register that works.
6 min read
Audit readiness
Proving population completeness to an auditor
Before an auditor samples, they test the list you sample from. How completeness and accuracy testing works, and how to get a population accepted first time.
6 min read
Compliance frameworks
How to choose a SOC 2 audit firm
The checks that matter when picking a SOC 2 auditor: licensing, peer review, independence, who does the fieldwork, and what a proposal should commit to.
6 min read
Security engineering
Branch protection rules auditors look for
The branch protection settings that make code review a testable control, the bypass paths auditors probe, and the evidence that proves it held all period.
7 min read
Security engineering
Code review as a change management control
For most software teams, the pull request review is the change approval. What it must establish, which changes it must cover, and how auditors sample it.
6 min read
Compliance frameworks
What a SOC 2 readiness assessment should cover
The eight areas a SOC 2 readiness assessment should cover, the outputs you should expect from it, and how to tell a useful assessment from a checklist.
6 min read
Audit readiness
Screenshots vs system-generated evidence
When a screenshot is acceptable audit evidence, what it must show, why exports and system reports usually serve better, and how auditors test the reports.
6 min read
Trust and sales
Security reviews for startups without a report yet
How a startup with no SOC 2 report can still pass a buyer's security review: what to offer instead, how to present the audit timeline, and what to avoid.
6 min read
Security engineering
Business continuity and disaster recovery plans
Continuity keeps the business running; recovery restores the technology. How to run an impact analysis, map dependencies, write both plans, and test them.
6 min read
Compliance frameworks
Choosing your SOC 2 Type II observation period
How to choose the length and dates of a SOC 2 Type II observation period: what each length allows, how control frequency limits it, and where to put the end.
6 min read
Security engineering
Backup and restore testing
A backup is only a control once you have restored from it. What to back up, how to keep backups out of an incident's reach, and how to run and record restores.
6 min read
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read