SOC 2
6 articles tagged “SOC 2”.
-
Provider Incident Evidence Retention: Keep It Past 90 Days
AWS, Azure, Google, Cloudflare and GitHub drop most incident history within 30-90 days. How to keep provider evidence for SOC 2, SOX and PCI change audits.
-
SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
-
Vanta vs Drata vs Secureframe: Evidence Collection Compared
How Vanta, Drata, and Secureframe handle custom controls, evidence automation, and auditor access — with a named weakness for each GRC platform.
-
The Compensating Controls Register Auditors Accept
You deferred a control and promised a compensating one. Here is the register entry that PCI, SOC 2, and NIST assessors sign off on instead of flagging.
-
Risk-Based Patching: How to Defend It to an Auditor
You skipped a Critical CVSS because EPSS said low-risk. Here is the evidence trail that keeps a PCI, SOC 2, or SOX auditor satisfied.
-
SOC 2 Change Management Controls and Real Audit Questions
SOC 2 change management under CC8.1, CC7.1, and CC6: what auditors actually ask, what evidence to keep, and where automation falls short.