Resources

Compliance, simplified

Guides, walkthroughs, and deep-dives on SOC 2, ISO 27001, HIPAA, and evidence automation.

47 guides · Page 3 of 4Compliance glossary

Third-Party Due Diligence Evidence for SOC 2

What to keep in each vendor due diligence file for SOC 2: questionnaires, SOC report review with bridge letters and CUECs, contract security clauses, residual risk acceptance, and ongoing monitoring.

Mapping Zero Trust Controls to SOC 2 Evidence

Practical crosswalk from common Zero Trust practices, including identity, device posture, segmentation, continuous verification, and least privilege, to SOC 2 criteria and the evidence auditors sample.

Disaster Recovery Evidence for SOC 2

How-to evidence playbook for SOC 2 disaster recovery: DR plans, RTO and RPO records, backup logs, restore tests, tabletop and failover exercises, Availability sampling, and common failures.

Incident Response Evidence for SOC 2

How-to evidence playbook for SOC 2 incident response: tickets, severity, timelines, communications, post-incident review, period sampling, and common failures.

Vulnerability Management Evidence for SOC 2

Operating playbook for proving vulnerability management across a SOC 2 audit period: scan cadence, severity SLAs, exception handling, remediation verification, Type 2 sampling, and common failures.

Role-Based Access Control Evidence for SOC 2

How-to evidence playbook for proving RBAC design and operation across a SOC 2 audit period: role catalogs, permission matrices, assignment evidence, privileged elevation, Type 2 sampling, and common failures.

Risk Register Evidence for SOC 2

How-to evidence playbook for maintaining and proving a risk register across a SOC 2 audit period: fields, owners, treatment decisions, refresh triggers, Type 2 sampling, and common failures.

Risk Assessment Evidence for SOC 2

How-to evidence playbook for risk assessment across a SOC 2 audit period: scope, methodology, register fields, treatment decisions, trigger refresh, Type 2 sampling, and common failures.

Security Awareness Training Evidence for SOC 2

How-to evidence playbook for security awareness training across a SOC 2 audit period: population, curriculum, new hire and renewals, incompletes, exports, and sampling.

Policy Acknowledgement Evidence for SOC 2

How-to evidence playbook for workforce policy acknowledgements across a SOC 2 audit period: which policies, new hire and renewals, versioning, contractors, incomplete rates, and sampling.

Mapping Controls Across SOC 2 and ISO 27001

Crosswalk-style playbook for mapping shared controls between SOC 2 and ISO 27001: evidence reuse, multi-framework operating models, and pitfalls of naive one-to-one mapping.

Building a Written Information Security Program (WISP)

Operating playbook for creating and maintaining a WISP: scope, policy package, owners, acknowledgements, evidence linkage, and SOC 2 period discipline.