Resources
Everything we publish and everything we ship, in one place: how evidence actually gets collected, how controls get mapped, and what auditors really ask for.
AWS CloudTrail evidence for SOC 2 CC7 controls
Which CloudTrail events an auditor will actually accept, how to scope the query so it proves something, and why retention is usually the thing that fails you.
Engineering4 September 2026
What auditors actually ask for during SOC 2 fieldwork
Not your policy library. A population, a sample drawn from it, and a defensible reason the two match — plus what happens when the arithmetic does not work.
Evidence28 August 2026
SIG Lite vs SIG Core vs CAIQ — which questionnaire to use
Three standard questionnaires, three very different asks. A straight comparison of length, scope and what each one is actually good at, plus when to send none of them.
Vendor risk21 August 2026
Continuous control monitoring vs point-in-time audit
They answer different questions, and confusing the two is how teams end up surprised at fieldwork. What each proves, where the gap sits, and why evidence has a half-life.
Compliance14 August 2026
A SOC 2 evidence collection checklist that survives fieldwork
What to collect for each Trust Services Criteria section, in what form, and how often — organised by the thing an auditor will actually ask you to produce.
Evidence7 August 2026
Mapping ISO 27001 Annex A to SOC 2 — where the overlap really is
The second framework is mostly re-filing, not double work. Where Annex A and the Trust Services Criteria genuinely coincide, and the four areas where neither covers the other.
Compliance31 July 2026