Compliance, in plain English
Definitions of the terms, frameworks, and concepts that show up in every audit.
What is the CAIQ?
The CAIQ is the Cloud Security Alliance's questionnaire for documenting a cloud provider's security controls, built on the Cloud Controls Matrix.
What is compliance automation?
Compliance automation is software that collects evidence and checks controls on a schedule. Here is what it does well and where it still needs a person.
Compliance Maturity Model: Five Stages from Manual to AI-Automated
The compliance maturity model scores how automated each security control is, from manual evidence uploads to AI-driven remediation. Learn the five stages.
Continuous Compliance: What It Means and How to Build It
Continuous compliance is the practice of monitoring security controls automatically, year-round, instead of scrambling to prepare evidence at audit time.
What are compliance controls?
Controls are the specific safeguards an organization implements and evidences to meet a security or compliance framework requirement.
What is evidence collection in compliance?
Evidence collection is the process of gathering proof that a security control operates as designed, for an auditor to sample and test.
What is the SIG Questionnaire?
The SIG is Shared Assessments' third-party risk questionnaire, published in a shorter SIG Lite and a comprehensive SIG Core version.
SOC 2 Type 1 vs Type 2: What Is the Difference?
SOC 2 Type 1 confirms your controls are designed correctly. SOC 2 Type 2 proves they worked over time. Here is how to choose and when each matters.
Trust Services Criteria: The Complete Breakdown for SOC 2
The Trust Services Criteria (TSC) are the five categories that define what SOC 2 measures. Learn each category, the key controls, and which ones you need.
What is ISO 27001? The Standard Explained for Startups
ISO 27001 is the international standard for information security management systems (ISMS). Learn what it covers and how it differs from SOC 2.
What is SOC 2? A Complete Guide for Startups
SOC 2 is a security audit framework that verifies whether a SaaS company protects customer data. Here is what it means, who needs it, and how long it takes.