Resources

Compliance, simplified

Guides, walkthroughs, and deep-dives on SOC 2, ISO 27001, HIPAA, and evidence automation.

48 guides · Page 1 of 4Compliance glossary

CC6.1 Logical Access Controls Explained with Evidence Examples

What SOC 2 CC6.1 is about, the evidence teams commonly keep for logical access, and the gaps auditors often find.

Where Engineering Evidence Fits Next to Vanta or Drata

How to think about GitHub, Jira, and deploy evidence alongside a compliance automation platform, and what to confirm before SOC 2 fieldwork.

Linking Jira Tickets to GitHub Deploys for Audit Traceability

How to link Jira tickets, GitHub pull requests, and deploys so SOC 2 auditors can trace each sampled change from request to release.

Jira Change Ticket Evidence for SOC 2

What auditors look for in a Jira change ticket, how to build a complete change population, and how to link tickets to pull requests and deploys for SOC 2 sampling.

SOC 2 Type 2 Sampling: How Auditors Pick Samples

How auditors select Type 2 samples, why complete populations matter more than guessing sample sizes, and how teams prepare evidence packages for fieldwork.

Network Segmentation Evidence for SOC 2

Which records to keep for network segmentation in a SOC 2 audit: zone diagrams, enforcing configs, rule-change approvals, reviews, and period evidence.

CAPA and Corrective Action Evidence for SOC 2

Which records to keep for each step of a corrective and preventive action workflow: issue intake, owners, root cause, fixes, effectiveness checks, and closure.

Pull Request Review Evidence for SOC 2

How to show that each sampled change was independently reviewed and approved before merge: building the change population, tested attributes, exporting review records, and edge cases.

GitHub Branch Protection Evidence for SOC 2

What to collect to show GitHub branch protection supported your SOC 2 change control: repository inventory, protection and ruleset settings, bypass lists, audit log history, and sampled pull requests.

CC8.1 Change Management Controls: What Auditors Test

What SOC 2 CC8.1 covers and how auditors commonly test it: walkthroughs, configuration inspection, change populations, sampling, and the attributes checked on each change.

Compensating Controls Evidence for SOC 2

How to document, approve, run, and retire compensating controls for SOC 2 when a primary control cannot operate: risk linkage, residual risk approval, execution records, and Type 2 sampling.

Business Continuity Plan Evidence for SOC 2

How to prove business continuity controls for SOC 2 across an audit period: business impact analysis inputs, plan ownership and review, tabletop exercises, follow-up actions, and Availability sampling.