Resources for audit and testing decisions
218 guides across seven frameworks, three hands-on tools, a buyer's checklist for security testing, and a glossary of the terms you will hear. Start from your situation, or go straight to a framework.
Where to start
What is happening to you?
- SOC 2 complianceA customer asked for a SOC 2 report
What the report is, what an auditor examines, and how Type I differs from Type II.
- ISO 27001 complianceWe want an internationally recognised certificate
How an information security management system is built, then certified by an outside body.
- ISO 42001 complianceWe build or buy AI products
Governing AI risk in a way an auditor, a customer and a regulator can all follow.
- GDPR complianceWe hold personal data of EU or Indian users
Your duties around lawful use, rights requests and breaches, under GDPR and the DPDP Act.
- HIPAA complianceWe handle US health information
What the HIPAA Security Rule expects, and how business associates fit in.
- Security testingWe need to know if we can be broken into
Testing that proves what an attacker can reach, with the fixes retested.
The guides
Every guide, by framework.
SOC 2 & the SOC family
Attestation reports for customer data security, plus SOC 1 and SOC 3.
Start here08
- What is SOC 2?The attestation, the five categories, Type 1 vs Type 2, in plain words.
- Is there a SOC 2 certificate?No. What to say instead, and how to verify a vendor's claim.
- SOC 2 Type 1 vs Type 2Snapshot or period, the observation window, and moving between them.
- SOC 1 vs SOC 2 vs SOC 3Who asks for each report, how the three differ, and when you need two.
- SOC 2 vs ISO 27001One access review followed through both audits, and what each reviewer asks.
- Who can sign a SOC 2 report?Only a licensed CPA firm, independent of whoever built your controls.
- A SOC 2 attestation, explainedWhat an attestation is, who may give one, and what you may call the result.
- Your first framework: SOC 2 or ISO 27001?A decision path by market, buyer and team.
Scope & criteria12
- Trust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
- Scope & the system boundaryWhat's in, what's carved out, and the CUECs your customers own.
- Writing the system descriptionA drafting workflow for the description, from facts to a review loop.
- The SOC 2 controls listNo official list. Example controls grouped by the team that owns them.
- SOC 2 scope emulatorSwitch your commitments and data on and off; see which categories they pull in.
- Hosting on a SOC 2 cloud: what you inheritWhat a provider's report covers, and the controls that stay yours.
- Carve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.
- Picking categories beyond SecurityWhich of the five categories your customers actually need.
- Confidentiality and Privacy: the pair people confuseCompany data against personal information, and when each applies.
- Several products, one report?Drawing a system boundary when you sell more than one product.
- Subservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- Complementary controls: what customers and vendors owe the systemCUECs and CSOCs, written so they can actually be checked.
The five categories05
- The Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
- The Availability categoryA1.1 to A1.3: capacity, protection and tested recovery.
- The Confidentiality categoryC1.1 and C1.2: identifying, protecting and disposing of confidential data.
- The Privacy categoryP1 to P8: notice, choice, collection, use, access, disclosure, quality, monitoring.
- The Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.
Running the engagement14
- SOC 2 timeline & roadmapThe seven phases from scoping to the annual cycle.
- SOC 2 audit preparationThe auditor's request list, complete populations, and a dry run before fieldwork.
- SOC 2 compliance checklistChecks grouped by who has to act, with the record that proves each.
- Ten SOC 2 pitfallsThe predictable mistakes in scoping, the period and fieldwork.
- Sampling & deviationsPopulations first, how samples are picked, and what one miss means.
- Pen tests & recovery testsNo criterion demands either. Your own control wording does.
- An incident during the periodWhy an incident is not automatically an exception, and what to disclose.
- Continuous monitoring & year twoMonitoring as a criterion, a calendar of control frequency, and early signs of drift.
- SOC 2 on a small teamWhat you can simplify, and what no team size excuses.
- Changing systems mid-auditHow the observation period copes with migrations, tools and people.
- From a Type 1 report to a Type 2What carries over, what is tested again, and what to start logging.
- The readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
- Who owns each SOC 2 controlA role map from engineering to HR to leadership.
- Choosing the length of the observation periodThe trade-offs between a short and a long Type 2 window.
Evidence & testing03
Reading the report11
- How to read a SOC 2 reportFive questions to ask of any report, and where each answer sits.
- SOC 2 report X-rayClick through a sample report: 18 markers, one question each.
- Opinions & exceptionsThe path from one failed sample up to the opinion a report carries.
- Does SOC 2 mean you are secure?Reasonable assurance, what the report proves, and what it doesn't.
- Inside a SOC 2 report, section by sectionWho writes each section, and what each one is for.
- Auditor independenceThe line between helping you and auditing you.
- The management assertionWhat leadership is signing, and what backs it.
- Choosing a CPA firm for SOC 2Qualifications, peer review, and the questions worth asking.
- A scorecard for a vendor's SOC 2 reportTen checks that tell a useful report from a thin one.
- Can a firm outside the US issue a SOC 2?CPA licensing and affiliation, with India as the worked case.
- Getting a SOC 2 as a company based in IndiaWhat changes, what doesn't, and how to choose the examiner.
Selling with SOC 210
- SOC 2 in sales & questionnairesWhat the report answers, what it can't, and what to say mid-journey.
- Sharing your SOC 2 reportRestricted use, NDAs, prospects, and when a SOC 3 fits.
- Do your vendors need SOC 2?Tier vendors by reach, and accept the right evidence per tier.
- SOC 2 and GDPR, HIPAA, DPDPWhere SOC 2 overlaps each law, and where it stops.
- SOC 2 by industryWhat twelve sectors usually scope in, and what gets scrutinised.
- SOC 2 and security questionnairesWhat each one settles, and how to answer without repeating yourself.
- How long a SOC 2 report stays usefulThe age buyers accept, and what to do when yours ages out.
- SOC 2 bridge lettersWhat a bridge letter says, who signs it, and its limits.
- Your second SOC 2: renewal and the continuous cycleBack-to-back periods, what year two repeats, and what it adds.
- “SOC 2 in progress”: what you can honestly sayWording that is true at each stage, and wording to avoid.
SOC 2 by industry12
- SOC 2 for SaaS and cloud companiesMulti-tenant data, the shared stack, and what buyers ask first.
- SOC 2 for fintechMoney movement, partner banks and processing integrity.
- SOC 2 for AI companiesTraining data, model providers and customer prompts.
- SOC 2 for healthtechWhere SOC 2 sits beside HIPAA, and the categories it leans on.
- SOC 2 for e-commerce platformsMerchant data, payment flows and peak-load availability.
- SOC 2 for MSPs and IT service providersPrivileged access into other people's systems.
- SOC 2 for edtechStudent data, school buyers and consent.
- SOC 2 for HR and payroll techEmployee records, payroll accuracy and access separation.
- SOC 2 for consulting and professional servicesClient data held on laptops, email and shared drives.
- SOC 2 for data analytics companiesIngested data, pipelines and what customers can query.
- SOC 2 for developer toolsSource code, secrets and CI/CD as customer data.
- SOC 2 for logistics and supply chain softwareShipment data, integrations and partner portals.
AT-C & AICPA standards07
- The AICPA attestation standards, mappedHow SSAE 18, the AT-C sections and the SOC suites fit together.
- AT-C 105: ideas behind every attestationPractitioner, subject matter, criteria, assertion: the vocabulary of every report.
- AT-C 205: how an examination is runPlanning, testing and reporting on an examination engagement.
- AT-C 320: the SOC 1 standardControls at a service organization that touch financial reporting.
- SSAE 18: what the codification didWhy the standards were recodified, and what changed for service organizations.
- DC 200: what a system description is measured againstThe description criteria, and how an auditor tests a description.
- TSP 100: how the criteria document is builtCategories, criteria and points of focus, and why the 2017 set still applies.
SOC 1: understanding it07
- SOC 1, explainedWhat a SOC 1 covers, AT-C 320, and bridge letters.
- Who is who in a SOC 1The service organization, user entities and user auditors, and how a report moves between them.
- Who needs a SOC 1 report?A test for service providers whose work touches clients' financial statements.
- SOC 1 Type 1 vs Type 2Design at a date or operation over a period, and what auditors want.
- SOC 1 or SOC 2: which do you need?A decision path for service providers asked for either.
- SOC 1 and Sarbanes-OxleyHow a service provider's report feeds a client's SOX work.
- SOC 1 and ISO 27001A financial-controls report next to a security certificate.
SOC 1: what is inside07
- Control objectives in a SOC 1How to write them, and why they come before the controls.
- ICFR and SOC 1 controlsWhich controls matter to a client's financial reporting.
- The SOC 1 system descriptionWhat the description must say, and how it is tested.
- User entity controls in a SOC 1What clients must do for your controls to work.
- Subservice organizations in a SOC 1Carve-out or inclusive for the vendors behind your service.
- How to read a SOC 1 reportThe sections, the opinion, and the exceptions that matter.
- SOC 1 bridge lettersCovering the gap after a period ends, for a client's auditor.
SOC 1: getting one07
- Preparing for a SOC 1 examinationWhat to have ready before fieldwork starts.
- A SOC 1 readiness checklistA working list to test your position before you engage a CPA firm.
- SOC 1 phases from scoping to reportThe order of work, from scoping to the issued report.
- SOC 1 for payroll providersCalculation, cut-offs and file transfers a client's auditor tests.
- SOC 1 for fintech and paymentsMoney movement, reconciliations and settlement.
- SOC 1 for mortgage and loan servicingPayments, escrow and investor reporting.
- SOC 1 for BPO and outsourced accountingProcessing on behalf of a client's finance team.
SOC 303
The library index01
ISO 27001
The certifiable information security management system.
The basics06
- What is an ISMS?The management system ISO 27001 certifies: policies, risk, controls, review.
- Information security policyThe top-level policy Clause 5.2 requires, and what makes one work.
- Access control explainedLeast privilege, RBAC vs ABAC, and the access reviews auditors test.
- An ISO 27001 implementation roadmapThe order of work from scope to certification audit.
- What ISO 27001 requires, in one placeEvery requirement at a glance, with the page that explains each.
- Who needs ISO 27001?The buyers, laws and situations that make it worth doing.
The standard05
- ISO 27001 Annex A controlsAll 93 controls in four themes, with what each one asks.
- ISO 27001 mandatory documentsWhat the standard requires you to document, clause by clause.
- ISO 27001 vs ISO 27002The requirements standard and the guidance standard, side by side.
- What ISO 27001 requires, in one placeEvery requirement at a glance, with the page that explains each.
- The Statement of ApplicabilityHow to build the document auditors open first.
Clauses 4 to 1012
- Clause 4: context of the organisationYour context, interested parties and the boundary of the ISMS.
- Writing the ISMS scope statementHow to draw the line and word it so an auditor accepts it.
- Clause 5: leadershipWhat top management must do, say and be able to show.
- Clause 6: planningRisks, objectives and planned change, as the standard sequences them.
- Risk assessment and treatmentA method that is repeatable, with the records an auditor reads.
- Clause 7: supportResources, competence, awareness and communication.
- Documented informationWhat to write, how to control it, and how little is enough.
- Clause 8: operationRunning the risk work you planned, and keeping the evidence.
- Clause 9: performance evaluationMeasuring, auditing and reviewing the system.
- The ISO 27001 internal auditWho may audit, what to test, and how to report.
- The management reviewThe inputs and outputs the standard lists, and a workable agenda.
- Nonconformity and corrective actionFrom a finding to a fix that holds, with root cause.
Annex A by theme04
- Annex A organizational controlsThe 37 controls of the first theme, grouped by what they do.
- Annex A people controlsThe 8 controls on hiring, training, and leaving.
- Annex A physical controlsThe 14 controls on sites, equipment and media.
- Annex A technological controlsThe 34 controls on systems, networks, code and data.
Controls auditors ask about14
- Supplier security controlsVetting, contracts and monitoring for the vendors you rely on.
- Cloud services securityChoosing, using and leaving a cloud service, under the standard.
- Incident management controlsPlanning, responding, learning, and the records between them.
- Continuity and ICT readinessRecovery objectives and tests, and what an auditor samples.
- Threat intelligenceThe newer control, and a proportionate way to meet it.
- Assets and information classificationThe inventory, owners, labels and handling rules.
- Security awareness and trainingWhat to teach, who to teach, and the proof.
- Technical vulnerability managementFinding, ranking and fixing weaknesses on a schedule.
- Configuration managementBaselines, drift and hardened builds.
- Backup and redundancyWhat to back up, restore tests, and spare capacity.
- Logging and monitoringWhat to log, how long to keep it, and who looks.
- Cryptography and key managementWhere to use it, who holds keys, and the policy behind it.
- Secure developmentFrom requirements to code review and testing.
- Change managementRequesting, approving, testing and recording change.
Putting it to work04
- How long an ISO 27001 certificate lastsThe cycle of audits, and what keeps a certificate valid.
- Penetration testing and ISO 27001What the standard expects, and what auditors accept.
- ISO 27001 and SOC 2 togetherRunning one programme for two audits.
- ISO 27001 for startupsA lean ISMS that still passes an audit.
ISO 27001 and Indian regulators06
- ISO 27001 and SEBI's cyber frameworkWhere the certificate helps a SEBI-regulated entity.
- ISO 27001 for IRDAI-regulated insurersInsurer security expectations next to the standard.
- ISO 27001 and RBI expectationsBanks, NBFCs and RBI requirements, mapped to the ISMS.
- ISO 27001 and CERT-In directionsIncident reporting and logging duties, and the ISMS.
- ISO 27001 and the DPDP ActHow the ISMS carries the Act's security safeguards duty.
- ISO 27001 across Indian regulatorsOne table of who asks for what, and how the ISMS answers.
ISO 42001 & AI governance
The certifiable AI management system, and the laws around it.
Start here03
The standard02
Certification02
GDPR & data privacy
The EU's personal data law, and India's DPDP Act beside it.
Foundations03
Individuals & risk03
India's DPDP Act
India's digital personal data law, and how it meets GDPR.
The Act and its roles08
- The DPDP Act, 2023 in plain wordsWho it covers, the key terms, and how the law is laid out.
- Data fiduciary, processor or consent manager?The three roles the Act names, and which one you are.
- What a data fiduciary must doThe duties, from notice to security to erasure.
- Data principal rights, and running requestsThe rights people hold, and a workflow that answers them.
- Valid consent and noticesWhat a notice says and what makes consent count.
- Consent managersWhat a consent manager does, and when you would use one.
- Children's data and parental consentVerifiable consent, the limits on tracking, and the exemptions.
- Processing without consentThe legitimate uses and the exemptions, and their limits.
Duties and enforcement05
- Sending personal data out of IndiaHow the Act treats transfers abroad, and where other laws bite.
- Personal data breaches under the DPDP ActWho must be told, what they are told, and your records.
- Significant data fiduciariesThe extra duties: DPO, audits and impact assessments.
- The Data Protection Board and penaltiesHow enforcement works and the ceilings the Act sets.
- The DPDP Rules, 2025What the Rules add to the Act, and how they phase in.
Getting ready06
- Data mapping and the processing recordThe inventory every other DPDP task depends on.
- A DPDP implementation roadmapThe phases from data map to evidence, in a sensible order.
- A DPDP compliance checklistA working list to test your programme against.
- Retention and erasureWhen data must go, and how to prove that it did.
- Reasonable security safeguards, in practiceWhat the duty asks, and how ISO 27001 and SOC 2 evidence it.
- Grievance redressal and the contact pointWho people write to, and how complaints are handled.
By sector and neighbouring law03
DPDP & GDPR03
HIPAA
Protecting health information in the US.
The rules, one by one05
- What counts as PHI?Protected health information, the identifiers, and when data stops being PHI.
- The HIPAA Privacy RuleUses and disclosures, patient rights, and the minimum necessary idea.
- The HIPAA Security RuleThe three safeguard families that protect electronic PHI, and what addressable means.
- The Breach Notification RuleWhat counts as a breach, who is told, and the clocks that run.
- Business Associate AgreementsWho needs one, what it must contain, and where teams go wrong.
Doing the work03
HIPAA in the cloud04
- HIPAA in the cloudShared responsibility, the BAA, and what stays with you.
- HIPAA on AWSEligible services, the agreement, and configuring them well.
- HIPAA on Microsoft AzureThe agreement, covered services and the controls you own.
- HIPAA on Google CloudThe agreement, covered products and the settings that matter.
Serving US clients, and other frameworks02
NIST CSF & risk
The six-function security framework, risk methods and GRC.
The framework02
Choosing frameworks02
Interactive
Try it before you read it.
- EmulatorSOC 2 scope emulatorSwitch your commitments and data on and off; see which categories they pull in.
- Interactive reportSOC 2 report X-rayClick through a sample report: 18 markers, one question each.
- EmulatorAI role emulatorProvider or deployer? Describe your AI and see what's yours to evidence.
Before you buy a test
Six questions to put to any testing vendor.
Security testing is easy to buy and hard to judge. These questions separate an assessment that changes your risk from one that produces a PDF.
See how we run testing- 01
Who does the testing, and who reviews the report?
Ask for the seniority of the person doing the work, and whether a second person reviews findings.
- 02
How much is manual, and how much is scanner output?
Automation clears known ground. Judgement-based flaws, like business logic and authorization, come from people.
- 03
Is the scope written down?
Targets, test windows and rules of engagement should be agreed in writing before work begins.
- 04
Will I get steps to reproduce each finding?
A finding your engineers cannot reproduce is hard to fix and hard to trust.
- 05
How are critical findings handled during the test?
A serious flaw should be flagged straight away, not saved for the final report.
- 06
Is retesting included?
A fix is only closed once someone has verified it. Ask whether the report is reissued afterwards.
Glossary
The terms you will hear, in plain words.
- Attestation
An auditor's written opinion on whether your controls meet a set of criteria. SOC 2 is an attestation, not a certificate.
- Certification
Formal confirmation by an accredited body that a management system meets a standard, as with ISO 27001.
- Control
A rule, setting or practice that reduces a specific risk, such as requiring multi-factor sign-in.
- CVSS
A common severity score from 0 to 10 for a technical weakness. It describes the flaw, not your business risk.
- Data fiduciary
India's DPDP Act term for the organisation that decides why and how personal data is processed.
- DPIA
A data protection impact assessment: a structured look at risks to people before high-risk processing begins.
- Evidence
Records showing a control actually ran: logs, tickets, approvals, screenshots with dates.
- Gap assessment
Comparing what you do today with what a standard asks, to list what is missing and in what order to fix it.
- ISMS
An information security management system: the policies, roles and routines ISO 27001 asks you to run and improve.
- Lawful basis
The legal ground that lets you use personal data under GDPR. There are six, and you pick one per purpose.
- OWASP Top 10
A widely used list of the most common web application risks, kept by an open community.
- Penetration test
A controlled attack by people, with permission, to find and prove the flaws an intruder could use.
- PHI
Protected health information: health data tied to a person that HIPAA requires you to safeguard.
- Remediation
Fixing a finding, or reducing its risk, and then showing that it worked.
- Retest
A second round of checks that verifies each fix, so a finding can be marked closed with proof.
- Rules of engagement
The written limits of a test: what may be attacked, when, and who to call if something goes wrong.
- Scope
The systems, people, sites and period an audit or test covers. Anything outside it is not assessed.
- Statement of Applicability
The ISO 27001 document listing which Annex A controls apply to you and why.
- Type I and Type II
SOC 2 report kinds. Type I checks design at one date. Type II checks operation over a period.
- Vulnerability scan
An automated search for known weaknesses. Useful, but it does not prove how they chain together.
From the blog
Recent articles.
What actually happens during a web application penetration test
A stage-by-stage walkthrough of a typical engagement, and what to expect from your side of it.
SOC 2 Type I vs Type II: which one do you actually need?
The difference is not rigour, it is time — and picking the wrong one costs either months or credibility.
Why a vulnerability scan is not a penetration test
They cost different amounts, answer different questions, and are routinely sold as though they are interchangeable.
Beyond the reading
Want this applied to your own systems?
Guides explain the framework. A readiness assessment or a scoped test applies it to your contracts, systems and evidence, and tells you what to fix first.