News & Article

Category: SOC2 Update

Banner about AI Acceptable Use Policy for SOC 2, showing policy books, a laptop checklist, and key controls icons on the right.

SOC2 Update

AI Acceptable Use Policy for SOC 2: What to Include and Prove

How an AI acceptable use policy supports SOC 2: how AI risks map to existing criteria, what the policy should contain and the evidence auditors

October 23, 2026

Desk setup for penetration testing with a laptop displaying a testing dashboard, a checklist notebook, and a stack of related books on the table.

SOC2 Update

Penetration Testing for SOC 2: Scope, Timing and Evidence

How to run a penetration test that supports SOC 2: scope, tester independence, timing in the observation period, remediation tracking and the evidence auditors request.

October 23, 2026

SOC 2 logging and monitoring requirements: what to log, retain and review, with a laptop security dashboard and stacks of policy books on a desk.

SOC2 Update

SOC 2 Logging and Monitoring Requirements: What to Log and Keep

What SOC 2 expects for logging and monitoring: CC7.1 to CC7.4, a risk-based list of log sources, retention without invented rules, and the evidence auditors

October 22, 2026

Stack of black binders on a desk labeled Policies & Procedures to Incident Response beside a laptop showing Audit Evidence Sampling (Type II).

SOC2 Update

How SOC 2 Auditors Sample Evidence in a Type II Audit

How SOC 2 Type II audit sampling works: populations, sample selection, completeness of data, exceptions and how to prepare your evidence.

October 21, 2026

SOC 2 Backup and Disaster Recovery Testing

SOC2 Update

SOC 2 Backup and Disaster Recovery Testing: What Auditors Want to See

How SOC 2 treats backups and disaster recovery: A1.2 and A1.3, RTO and RPO, restore tests, and the evidence auditors sample during a Type II

October 20, 2026

SOC 2 Incident Response Plan Infographic

SOC2 Update

SOC 2 Incident Response Plan: What Auditors Expect and How to Prove It Works

What a SOC 2 incident response plan must cover under CC7.3 to CC7.5, the evidence auditors sample in a Type II period, and how to

October 19, 2026

SOC 2 User Access Reviews infographic: a laptop shows a 'User Access Review' table, with audit checklist on a notebook and stacked control books on a desk.

SOC2 Update

SOC 2 User Access Reviews: How to Run Them, How Often and What Evidence Auditors Sample

How to run SOC 2 user access reviews: how often, who reviews, what to check and the evidence auditors sample, with a step-by-step checklist.

October 18, 2026

Infographic banner showing steps to perform a SOC 2 risk assessment, with a laptop displaying a risk register and stacked manuals on a desk.

SOC2 Update

How to Perform a SOC 2 Risk Assessment: Step-by-Step with a Risk Register Example

A SOC 2 risk assessment shows auditors you identify and manage risks. Follow these steps with a sample risk register and evidence list.

October 17, 2026

SOC 2 System Description page mockup with a laptop showing Section 3, a stack of SOC 2 books, and a notes pad on a desk.

SOC2 Update

SOC 2 System Description: How to Write Section 3 That Auditors and Buyers Trust

How to write a SOC 2 system description that auditors accept and buyers trust: required elements, structure, a sample outline and mistakes to avoid.

October 16, 2026

SOC 2 infographic comparing Carve-Out Method vs Inclusive Method with a central VS circle and side panels detailing in-scope vs out-of-scope items.

SOC2 Update

SOC 2 Carve-Out vs Inclusive Method: How Subservice Providers Appear in Your Report

SOC 2 carve-out vs inclusive method: how subservice providers such as AWS appear in your report, what CSOCs are and what auditors expect.

October 15, 2026