From the compliance team
Guides on getting, and staying, audit-ready
What auditors actually check, how long each framework takes, what it costs, and how to run a program after the certificate. Written by the people who run Certifyi engagements, updated as the frameworks change.
Pillar guides
Long-form guides that link every article on the topic.
All articles
Newest first.
Incident response plans: what SOC 2 and ISO 27001 auditors actually check
What auditors test in an incident response plan: roles, severity levels, detection to containment steps, notification timelines under GDPR and...
Read the article
SOC 2 for AI companies: what changes when your product is a model
How SOC 2 applies when your product is an AI system: training-data controls, model change management, prompt and output logging,...
Read the article
Penetration test vs vulnerability scan for SOC 2: what auditors expect and how often
Does SOC 2 require a penetration test? The difference between scans and pen tests, which Trust Services Criteria they evidence,...
Read the article
The ISO 42001 certification process: from scope to certificate in seven steps
How ISO/IEC 42001 certification works: defining AI system scope, impact assessments, the 38 Annex A controls, Stage 1 and Stage...
Read the article
NIS 2: who is in scope, essential vs important entities, and what management must do
Who NIS 2 applies to: Annex I and II sectors, the size-cap rule, essential versus important entities, the ten minimum...
Read the article
Quantifying cyber risk: why Monte Carlo loss modelling beats heat maps in the boardroom
How to quantify cyber risk in currency: FAIR factors, Monte Carlo simulation, P50 and P90 loss exposure, why heat maps...
Read the article
PCI DSS 4.0: what changed, the requirements that became mandatory in 2025, and how to prepare
PCI DSS 4.0 and 4.0.1 explained: the twelve requirements, the customized approach, targeted risk analysis, MFA for all CDE access,...
Read the article
Essential Eight maturity levels explained: what Level 1, 2 and 3 actually require
The ACSC Essential Eight in plain terms: the eight strategies, what Maturity Level 1, 2 and 3 require for each,...
Read the article
Cyber Essentials vs Cyber Essentials Plus: the five controls, the difference, and which one you need
Cyber Essentials and Cyber Essentials Plus explained: the five technical controls, self-assessment versus hands-on audit, cost drivers, renewal, and which...
Read the article
CMMC Level 2 requirements explained: the 110 practices, who needs a C3PAO, and the timeline
CMMC Level 2 in plain terms: the 110 NIST SP 800-171 practices, self-assessment versus C3PAO, SPRS scores, POA&M rules and...
Read the article
ISO 27001:2022 changes: the 93 Annex A controls, the 11 new ones, and what the transition meant
What changed from ISO 27001:2013 to 2022: four control themes, 93 controls, 11 new controls such as threat intelligence and...
Read the article
What is a SOC 2 bridge letter, and when do customers ask for one?
A SOC 2 bridge letter covers the gap between your last report period and today. Who writes it, what it...
Read the article
DORA and NIS2 for SaaS vendors: what your EU customers will ask you for
DORA applies to EU financial entities and flows down to their ICT providers; NIS2 covers essential and important entities across...
Read the article
Evidence integrity: why hashed, versioned evidence changes what an audit can prove
What evidence integrity means, why auditors and regulators test it, how hashing and versioning work in a compliance record, and...
Read the article
What to publish in a trust center (and what to keep behind a request)
A trust center shortens enterprise security review when it shows the right things. What to publish openly, what to gate...
Read the article
How to build a vendor risk management program that auditors accept
A step-by-step vendor risk management program for SOC 2, ISO 27001 and GDPR: inventory, tiering by data and access, right-sized...
Read the article
ISO 42001 vs the EU AI Act: what each one asks for, and how they fit together
ISO 42001 is a certifiable standard; the EU AI Act is a regulation with obligations by risk tier. How they...
Read the article
Continuous compliance monitoring, explained: what it is and what it replaces
Continuous compliance monitoring collects control evidence automatically from connected systems. What it covers, what it does not, how auditors treat...
Read the article
How to choose a SOC 2 auditor (and what to ask before you sign)
What a SOC 2 auditor actually does, who is allowed to issue the report, how fees are structured, and the...
Read the article
SOC 2 for SaaS startups: getting your first report without derailing the roadmap
Your first SOC 2 competes with product work for engineering time. Here is how to scope and sequence it to...
Read the article
How to write security policies people actually follow
Template policies pass a document check and fail in practice. Here is how to write a policy set that survives...
Read the article
What is GRC, and when does a startup actually need it?
GRC covers governance, risk and compliance as one discipline. Here is what it means practically and when it stops being...
Read the article
ISO 27001 Stage 1 vs Stage 2 audit: what to expect
Stage 1 reviews your documentation, Stage 2 tests whether the ISMS operates. Here is what auditors check at each.
Read the article
How long does SOC 2 actually take?
Type 1 in one to three months, Type 2 adds the observation window. Here is what drives the timeline and...
Read the article
The best ISO 27001 compliance software in 2026
ISO 27001 demands governance artefacts SOC 2 does not. Here is which platforms handle an ISMS properly.
Read the article
The best SOC 2 compliance software in 2026
An honest comparison of SOC 2 platforms including Vanta, Drata, Secureframe, Sprinto, Scrut and Certifyi, with where each genuinely wins.
Read the article
How to prepare for an auditor evidence request
Fieldwork goes badly when evidence is assembled reactively. Here is how to prepare so the request list is routine.
Read the article
How to run access reviews auditors will accept
Access reviews are a top audit finding because they are performed but not evidenced. Here is how to run one...
Read the article
Automated vs manual evidence collection: what auditors accept
Auditors accept both, but they are not equal in cost or reliability. Here is where each works and where manual...
Read the article
Vendor risk management for small teams
You cannot assess every vendor equally. Here is a tiered approach that satisfies auditors without consuming your week.
Read the article
Have a question the guides do not answer?
Ask the person who would run your program. 30 minutes, no slides.