Resources

Compliance, simplified

Guides, walkthroughs, and deep-dives on SOC 2, ISO 27001, HIPAA, and evidence automation.

47 guides · Page 2 of 4Compliance glossary

Secure Software Development Evidence for SOC 2

How to prove secure development controls for SOC 2 across an audit period: a written standard, design reviews, enforced code review, security scans in CI, finding triage, controlled releases, and logged bypasses.

Secrets Management Evidence for SOC 2

How to prove secrets management controls for SOC 2 across an audit period: approved secret stores, restricted access, CI/CD injection without hardcoded credentials, rotation records, leaked-secret detection, and response tickets.

Privileged Access Management Evidence for SOC 2

How to prove privileged access controls for SOC 2 across an audit period: a complete admin and service account inventory, approved and time-limited elevation, break-glass records, credential protection, admin activity monitoring, and Type 2 sampling.

Data Classification Evidence for SOC 2

How to prove data classification for SOC 2 across an audit period: a testable tier scheme, a classified data inventory with owners, labeling, handling rule evidence by tier, change triggers, periodic review, and Type 2 sampling.

Multi-Factor Authentication Evidence for SOC 2

How to prove MFA for SOC 2 across an audit period: enforcement settings, enrollment coverage reconciled to your user population, onboarding samples, exceptions and bypasses, authenticator resets, service and break-glass accounts, and Type 2 sampling.

Subservice Organizations and CUECs in SOC 2: Carve-Out vs Inclusive Method

How your SOC 2 report treats subservice organizations under the carve-out and inclusive methods, what CSOCs and CUECs are, and the evidence service organizations keep to monitor providers and inform customers.

Asset Inventory Evidence for SOC 2

Evidence playbook for hardware, software, cloud resource, and SaaS inventories with owners and classification, keeping them current through change, and showing auditors complete populations across the audit period.

Data Retention and Disposal Evidence for SOC 2

Evidence playbook for SOC 2 data retention and disposal: retention schedules, deletion and disposal records, customer data deletion requests, media sanitization, Confidentiality criterion sampling, and Type 2 history.

Penetration Test Evidence for SOC 2: Scope, Reports, and Remediation

Evidence playbook for SOC 2 penetration testing: how to scope an engagement, what report and retest artifacts to keep, how to track findings to closure, and how pen test evidence differs from vulnerability scanning.

Encryption and Key Management Evidence for SOC 2

Evidence playbook for SOC 2 encryption and key management: data store inventory, encryption at rest and in transit settings, key access, rotation, certificates, exceptions, and Type 2 configuration history.

Logging and Monitoring Evidence for SOC 2

Evidence playbook for SOC 2 logging and monitoring: log source inventory, retention, alert rules and routing, review cadence, triage records, and Type 2 sampling.

Employee Onboarding and Offboarding Evidence for SOC 2

Evidence playbook for SOC 2 joiner-mover-leaver controls: HR triggers, provisioning approvals, MFA and device prerequisites, timely deprovisioning, and Type 2 sampling of hires and terminations.