Tag
SOC 2, page 3
75 articles
Audit readiness
First-audit mistakes, and how to avoid them
The mistakes that make a first SOC 2 or ISO 27001 audit slower and messier: aspirational policies, unknown populations, ignored vendors and the draft report.
6 min read
Security engineering
Patch management evidence
"Show us systems are patched" is a hard request when assets differ. The evidence that holds up for laptops, servers, containers and managed services, over time.
6 min read
Risk and vendors
Vendor tiering by data access
How to tier vendors by the data and systems they can reach, the intake questions that set a tier, what each tier triggers, and edge cases that mislead.
6 min read
Compliance frameworks
How to scope your first SOC 2 report
The seven scoping decisions for a first SOC 2: services, system boundaries, categories, report type, vendors, and customer duties, agreed before the audit.
6 min read
Audit readiness
The PBC list: handling auditor requests
How to run an audit request list: triage, a tracker with the right fields, file naming, quality checks before you send, and keeping sensitive data out.
6 min read
Security engineering
Vulnerability management SLAs auditors accept
Auditors test whether you met your own remediation windows. How to set severity tiers and SLAs you can keep, handle exceptions, and evidence every finding.
6 min read
Trust and sales
Gating documents behind an NDA
How to gate a SOC 2 report and other security documents: choosing the NDA mechanism, setting approval rules, expiring access, and keeping a usable log.
6 min read
Compliance frameworks
The SOC 2 privacy criterion compared with GDPR
How the SOC 2 privacy criteria P1 to P8 line up against GDPR, where they overlap, what GDPR requires that SOC 2 never tests, and when to include privacy.
6 min read
Security engineering
Joiner, mover, leaver processes
Joiner, mover, leaver is one access process with three triggers. How to run each event from the HR record, why movers get missed, and what evidence to keep.
6 min read
Audit readiness
Preparing control owners for auditor interviews
Who auditors interview, the questions control owners and staff are asked, a one-page briefing for each owner, and the line between preparing and coaching.
6 min read
Compliance frameworks
SOC 2 processing integrity: who needs it and why
Which services should include processing integrity in a SOC 2, how its five criteria turn into controls on inputs, processing, and outputs, and what it costs.
6 min read
Security engineering
Offboarding that removes access the same day
Late access removal is a classic audit exception. How to set a testable standard, start from a trigger you trust, and remove access in the right order.
6 min read
Trust and sales
What to put on a Trust Center
The documents and facts a Trust Center should carry, which belong in public view and which behind an NDA, and what should never be published there at all.
6 min read
Compliance frameworks
SOC 2 Type I vs Type II: what actually differs
Type I reports on design at a point in time. Type II reports on operation over a window. That single difference changes scoping, evidence and your timeline.
3 min read
Audit readiness
What happens in an audit walkthrough
What an auditor does in a control walkthrough, what they are testing, what to have open on screen, and the mistakes that turn a one-hour session into three.
6 min read
Compliance frameworks
The SOC 2 confidentiality criterion in practice
What C1.1 and C1.2 ask in practice: defining confidential data, finding every copy, deleting it on time at contract end, and the records an auditor samples.
6 min read
Security engineering
Managing privileged access
Admin accounts carry most of your access risk. How to find them, separate them, grant elevation for hours instead of years, and log what privileged users do.
6 min read
Audit readiness
How auditors sample controls
How SOC 2 auditors set sample sizes, select items from your population and handle a failed sample, and how ISO 27001 certification audits sample instead.
6 min read
Compliance frameworks
Should you include availability in your SOC 2?
How to decide whether availability belongs in your SOC 2: what it adds beyond security, the commitments that trigger it, and the evidence auditors will test.
6 min read
Security engineering
Least privilege in practice
Every framework asks for least privilege and none says how. Designing roles, finding excess access, separating duties on a small team, and proving all of it.
6 min read
Audit readiness
Types of audit evidence, and which is strongest
Inquiry, observation, inspection and reperformance, ranked the way auditing standards rank them, and what that ranking means for the records you keep.
6 min read
Compliance frameworks
What the SOC 2 security criterion actually requires
The SOC 2 security category is nine series of common criteria, CC1 to CC9. What each one asks, what evidence auditors test, and what the criteria leave to you.
7 min read
Security engineering
SSO as a compliance control
Single sign-on makes access controls cheaper to run and easier to prove, but only for the apps behind it. What SSO covers, what it misses, and what to test.
6 min read
Risk and vendors
Building a risk register auditors accept
The fields a risk register needs, how to write risks that are not missing controls in disguise, and the register mistakes auditors turn into findings.
7 min read