Pillar guide · 8 related articles
SOC 2 compliance guide
What a SOC 2 report is, what the auditor tests, and how to prepare without a scramble before fieldwork.
- Trust Services Criteria and scope
- Type I versus Type II
- Timeline and cost
From the compliance team
Guides on getting, and staying, audit-ready
What auditors actually check, how long each framework takes, what it costs, and how to run a programme after the certificate. Written by the people who run Certifyi engagements, updated as the frameworks change.
Start with a pillar guide
Long-form guides that cover a framework end to end and link to every article on it.
Pillar guide · 4 related articles
ISO 27001 certification guide
Scope, the Statement of Applicability, Stage 1 and Stage 2, and how the work maps to SOC 2.
- Scope and Statement of Applicability
- Stage 1 and Stage 2 audits
- Mapping to SOC 2
Pillar guide · 6 related articles
AI governance guide
ISO 42001, the EU AI Act and the NIST AI RMF, and how to run them as one programme.
- ISO/IEC 42001
- EU AI Act obligations
- NIST AI RMF
Showing 1 to 12 of 46 articles
-
Security
Incident response plans: what SOC 2 and ISO 27001 auditors actually check
What auditors test in an incident response plan: roles, severity levels, detection to containment steps, notification timelines under GDPR and NIS 2, tabletop exercises, post-incident review and the evidence to keep.
-
AI Governance
SOC 2 for AI companies: what changes when your product is a model
How SOC 2 applies when your product is an AI system: training-data controls, model change management, prompt and output logging, third-party model providers, and…
-
SOC 2
Penetration test vs vulnerability scan for SOC 2: what auditors expect and how often
Does SOC 2 require a penetration test? The difference between scans and pen tests, which Trust Services Criteria they evidence, how often to run…
-
ISO 42001
The ISO 42001 certification process: from scope to certificate in seven steps
How ISO/IEC 42001 certification works: defining AI system scope, impact assessments, the 38 Annex A controls, Stage 1 and Stage 2 audits, the three-year…
-
GRC
NIS 2: who is in scope, essential vs important entities, and what management must do
Who NIS 2 applies to: Annex I and II sectors, the size-cap rule, essential versus important entities, the ten minimum measures, 24-hour incident reporting…
-
GRC
Quantifying cyber risk: why Monte Carlo loss modelling beats heat maps in the boardroom
How to quantify cyber risk in currency: FAIR factors, Monte Carlo simulation, P50 and P90 loss exposure, why heat maps mislead boards, and how…
-
GRC
PCI DSS 4.0: what changed, the requirements that became mandatory in 2025, and how to prepare
PCI DSS 4.0 and 4.0.1 explained: the twelve requirements, the customized approach, targeted risk analysis, MFA for all CDE access, script management, and the…
-
Security
Essential Eight maturity levels explained: what Level 1, 2 and 3 actually require
The ACSC Essential Eight in plain terms: the eight strategies, what Maturity Level 1, 2 and 3 require for each, how to assess, and…
-
Security
Cyber Essentials vs Cyber Essentials Plus: the five controls, the difference, and which one you need
Cyber Essentials and Cyber Essentials Plus explained: the five technical controls, self-assessment versus hands-on audit, cost drivers, renewal, and which UK contracts require which…
-
GRC
CMMC Level 2 requirements explained: the 110 practices, who needs a C3PAO, and the timeline
CMMC Level 2 in plain terms: the 110 NIST SP 800-171 practices, self-assessment versus C3PAO, SPRS scores, POA&M rules and the phased rollout from…
-
ISO 27001
ISO 27001:2022 changes: the 93 Annex A controls, the 11 new ones, and what the transition meant
What changed from ISO 27001:2013 to 2022: four control themes, 93 controls, 11 new controls such as threat intelligence and DLP, and how to…
-
SOC 2
What is a SOC 2 bridge letter, and when do customers ask for one?
A SOC 2 bridge letter covers the gap between your last report period and today. Who writes it, what it must say, how long…
Have a question the guides do not answer?
Ask the person who would run your programme. Twenty minutes, no slides.