GRC
DORA and NIS2 for SaaS vendors: what your EU customers will ask you for
DORA applies to EU financial entities and flows down to their ICT providers; NIS2 covers essential and important entities across the EU. What each…
From the compliance team
Guides on getting, and staying, audit-ready
What auditors actually check, how long each framework takes, what it costs, and how to run a programme after the certificate. Written by the people who run Certifyi engagements, updated as the frameworks change.
Showing 13 to 24 of 46 articles
-
-
GRC
Evidence integrity: why hashed, versioned evidence changes what an audit can prove
What evidence integrity means, why auditors and regulators test it, how hashing and versioning work in a compliance record, and what to ask any…
-
Security
What to publish in a trust center (and what to keep behind a request)
A trust center shortens enterprise security review when it shows the right things. What to publish openly, what to gate behind a request, and…
-
TPRM
How to build a vendor risk management program that auditors accept
A step-by-step vendor risk management program for SOC 2, ISO 27001 and GDPR: inventory, tiering by data and access, right-sized questionnaires, evidence, contracts and…
-
AI Governance
ISO 42001 vs the EU AI Act: what each one asks for, and how they fit together
ISO 42001 is a certifiable standard; the EU AI Act is a regulation with obligations by risk tier. How they differ, where they overlap,…
-
Security
Continuous compliance monitoring, explained: what it is and what it replaces
Continuous compliance monitoring collects control evidence automatically from connected systems. What it covers, what it does not, how auditors treat it, and how it…
-
SOC 2
How to choose a SOC 2 auditor (and what to ask before you sign)
What a SOC 2 auditor actually does, who is allowed to issue the report, how fees are structured, and the nine questions that separate…
-
SOC 2
SOC 2 for SaaS startups: getting your first report without derailing the roadmap
Your first SOC 2 competes with product work for engineering time. Here is how to scope and sequence it to minimise that.
-
GRC
How to write security policies people actually follow
Template policies pass a document check and fail in practice. Here is how to write a policy set that survives an audit and real…
-
GRC
What is GRC, and when does a startup actually need it?
GRC covers governance, risk and compliance as one discipline. Here is what it means practically and when it stops being premature.
-
ISO 27001
ISO 27001 Stage 1 vs Stage 2 audit: what to expect
Stage 1 reviews your documentation, Stage 2 tests whether the ISMS operates. Here is what auditors check at each.
-
SOC 2
How long does SOC 2 actually take?
Type 1 in one to three months, Type 2 adds the observation window. Here is what drives the timeline and what compresses it.
Have a question the guides do not answer?
Ask the person who would run your programme. Twenty minutes, no slides.