Clear, no-nonsense advice on ISO 27001, SOC 2 and the frameworks that matter, from the people who do this work every day.
What actually drives the cost of ISO 27001, realistic 2026 ranges, and how small teams keep it affordable.
Read articleA copyable risk register, a likelihood and impact scale, a filled-in example, and how often HIPAA expects you to update it.
The ICO fee, EU representative fees, why GDPR has no mandatory audit, and where the real cost of compliance goes.
Published US ranges, audit days by headcount and environmental complexity, and the full three year audit cycle.
What a SOC 2 readiness assessment checks, what a firm charges, how a small team can run one in about a week, and a checklist for all 33 Common Criteria.
What an ISO 27001 gap analysis covers, a clause by clause checklist, a four-point scoring scale and what it costs to run one yourself.
Which level your contract calls for, the 15 and 110 requirements behind each, what each assessment costs, and what the July 2026 pause changed.
What the auditor checks in years 2 and 3, how many audit days it takes, and what a small organisation should budget.
What each window lets your auditor test, what it costs, and how to work backwards from a customer deadline.
The line-item breakdown, audit days by headcount, and the full three year total.
Realistic timelines by company size, the five phases, and how long the certificate lasts once you have it.
Published first year ranges, the software line, the penalty tiers, and why certification costs nothing.
The seven clause 9.3.2 inputs, a two hour agenda, and the evidence an auditor asks to see.
The fields a controller and a processor each record, and why the 250 employee exemption rarely applies.
The accredited audit fee, implementation, the platform price, and the full three year total.
The artefact each Annex A control needs, who produces it, and the sample size auditors ask for.
Every Annex A control with a draft justification, an Excel export, and no sign-up.
All ten self-assessment questionnaires, who each one is for, and what changed for SAQ A in 2025.
What the auditor checks in each stage, how long the gap is, and what a nonconformity actually costs you.
What a Level 2 self-assessment costs, what the suspended C3PAO path would cost, and what the estimates leave out.
What the letter must contain, who signs it, the three month limit, and when a buyer rejects it.
What Clause 9.2 requires, who is allowed to audit in a small team, and a sampling checklist.
What a compliance platform reads from your systems, what it cannot cover, and when to skip it.
Real published numbers, why most vendors hide the figure, and the costs software never covers.
From the auditor's side of the table: the evidence that passes first time, and the gaps that trigger findings.
The core policies every framework expects, and how editable templates get you there in days.
Control by control justifications, common rejection reasons, and a working example.
Drata, Secureframe, Sprinto, Thoropass, Scytale and CertAssist, compared on published price, system access and fit for a small team.
A plain-English guide to choosing between the two most requested certifications.
A lighter, no-integration option, with a fair look at Vanta, Drata and Sprinto too.
What the California Consumer Privacy Act requires, and how CCPA relates to GDPR.
When your startup actually needs SOC 2, what is involved, and how to get there without an enterprise budget.
Stale access is a top audit finding. How to run a clean review, with a checklist.
One is a voluntary report, the other is law. How they overlap, and when you need each.
Why HIPAA is a law you cannot certify to, and what HITRUST certification proves.
Who each applies to, how 800-171's 97 requirements derive from 800-53, and how CMMC fits.
Why NIST is not certifiable, how CSF and 800-53 differ, and why many teams use both.
Which one you certify to, how the 93 controls relate, and why you use both together.
93 controls in 4 themes, the 11 new controls, and the 2025 transition deadline.
What each assesses, the observation window, which costs more, and which to get first.
What each report proves, why there is no SOC 2 Type 3, and the one buyers want.
A breakdown by merchant level: SAQ, ASV scans, QSA audits, and how to keep it cheap.
The mandatory Clause 6.1.2 process, asset vs scenario methods, and the link to your SoA.
Where every dollar goes across platform, audit, pen test and consultant, and how to keep it low.
How the three big platforms are alike, where they differ, what they cost, and the simpler option.
How the tools work, what to look for, and why a certification reduces questionnaires.
Control counts (410 vs 323), how impact levels are set, and which one you need.
