Tag
SOC 2, page 2
75 articles
Compliance frameworks
SOC 2 exceptions and qualified opinions: what they mean
What a SOC 2 exception is, how auditors decide whether it changes the opinion, the four opinion types, and how to respond when your own report has findings.
6 min read
Trust and sales
Explaining shared responsibility to customers
How a SaaS provider explains which security controls it runs, which its cloud provider runs, and which customers own, in a matrix and in questionnaire answers.
6 min read
Audit readiness
Continuous monitoring vs point-in-time audits
What an audit covers that monitoring cannot, what monitoring catches that an audit finds too late, and how auditors treat the output of your monitoring.
6 min read
Security engineering
Running a tabletop exercise
A tabletop exercise is how most teams test an incident response plan. How to set objectives, write injects, run the session, and produce a report that counts.
6 min read
Compliance frameworks
How to read a SOC 2 report as a buyer
A buyer's order for reading a vendor's SOC 2 report: the opinion, period, scope, carve-outs, user entity controls, and test results, and what to record.
6 min read
Audit readiness
What auditors actually ask for
Fieldwork is mostly a request list. Knowing the shape of that list in advance turns a stressful three weeks into a week of sending things you already have.
3 min read
Audit readiness
Running several audits on one calendar
How to fit SOC 2, ISO 27001 and PCI DSS into one year: each audit's fixed dates, aligning or staggering fieldwork, and annual controls that serve all three.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
Compliance frameworks
What a SOC 2 bridge letter is and when buyers ask for one
What a SOC 2 bridge letter covers, who signs it, why it carries no auditor assurance, when buyers ask for one, and how to keep the gaps it covers short.
6 min read
Security engineering
Security monitoring and alerting
Logs prove nothing until someone looks. Which detections to build first, how to route and triage alerts, tune without losing coverage, and evidence it all.
6 min read
Audit readiness
Working well with your auditor
What your SOC 2 auditor or ISO certification body can and cannot help with, what to agree at kickoff, how to disagree with a finding, and what to ask after.
6 min read
Risk and vendors
Fourth-party risk, explained
What fourth-party risk is, where your vendors' vendors show up in SOC 2 reports and sub-processor lists, what GDPR and ISO 27001 expect, and what to do.
6 min read
Compliance frameworks
Carve-out vs inclusive: subservice organizations in SOC 2
How the carve-out and inclusive methods treat subservice organizations in a SOC 2, when each one fits, and the monitoring controls a carve-out requires.
6 min read
Security engineering
Centralized logging for compliance
What to log, what each event must contain, how long to keep it, and how to protect it. Centralized logging mapped to SOC 2, ISO 27001, PCI DSS and HIPAA.
5 min read
Audit readiness
What to do when a control fails mid-period
A control failed partway through your SOC 2 or ISO 27001 audit period. How to contain it, measure the extent, find the cause, and tell your auditor.
6 min read
Security engineering
Access reviews that hold up under audit
Most access reviews fail on evidence, not on rigor. Here is what an auditor samples, and the four artifacts that make a review defensible months later.
3 min read
Compliance frameworks
HITRUST vs SOC 2 for healthcare buyers
How a HITRUST certification and a SOC 2 report differ in who issues them, what they test and how long they last, and how to tell which your buyer needs.
6 min read
Compliance frameworks
Complementary user entity controls, explained
What complementary user entity controls are, why SOC 2 reports list them, how to write ones auditors and buyers accept, and what to do with a vendor's list.
6 min read
Security engineering
MDM vs a lightweight endpoint agent
MDM enforces device settings; a lightweight agent reports them. What auditors need from endpoints, when each approach fits, and how to combine the two.
6 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Audit readiness
Fixing gaps before the observation period starts
How to sort readiness gaps by type, decide which must close before a SOC 2 Type II period starts, prove each fix works, and pick a start date you can hold.
6 min read
Security engineering
Full-disk encryption on every laptop
A lost laptop is a non-event if you can prove it was encrypted. What the rules say, why recovery keys matter, and how to evidence encryption on every device.
5 min read
Compliance frameworks
Writing the SOC 2 system description
What the SOC 2 system description must contain under the AICPA's DC 200 criteria, how auditors test it, and how to write one that stays accurate.
6 min read
Compliance frameworks
Why the same control appears in four frameworks
SOC 2, ISO 27001, HIPAA and PCI DSS ask overlapping questions in different words. Mapping once and reusing the evidence is what makes the second one fast.
3 min read