Plain talk on what changed after the 2026 Delve scandal, and what it now takes to pass a real SOC 2 or ISO 27001 audit with evidence you can defend.
Certification cost is five line items across a three-year cycle, not one invoice. What sets certification body fees, the full cycle breakdown including surveillance and recertification, and why an unusually cheap quote is a risk, not a saving.
Read the guideEvery SOC 2 control environment depends on the customer doing something. What CUECs are, how they differ from user entity responsibilities and CSOCs, and why vague wording produces system description findings.
Read the guideSample size scales with control frequency, from one annual test to twenty or forty items on a daily control. More Type 2 exceptions come from populations that could not be produced completely than from controls that actually failed.
Read the guideMost people receiving a SOC 2 report confirm the file exists and move on. Eight checks, about twenty minutes: opinion wording, audit period, the auditor's CPA license, sample sizes, and the red flags that matter.
Read the guideClause 9.2 does not require a checklist. It requires an audit program that reaches an objective conclusion. Clause by clause and control by control: the questions asked, the records requested, and how nonconformities get worded.
Read the guideCertification bodies read your internal audit report to decide how much they can trust your entire ISMS. What the report must contain, how to grade nonconformities honestly, and the failures that turn the report itself into a finding.
Read the guideA section-by-section drafting playbook that maps each of the nine DC 200 criteria to what management must actually write, from an auditor's chair. Includes a worked example and a drafting checklist.
Read the guideType 1 tests control design at a point in time. Type 2 tests design and operating effectiveness across a 3 to 12 month period. Here is how to choose, what a bridge letter can and cannot do, and what enterprise buyers really expect.
Read the guideMost SOC 2 Type 2 failures are evidence failures. Not because the controls did not work, but because nobody collected proof they worked across the full audit window. Here is how to build an evidence program that produces a clean report.
Read the guideAT-C 105 and AT-C 205 govern every SOC 2 examination. Most service organizations have never read them. Here is what they require and how auditors apply them in practice.
Read the guideDC 200 defines every element your Section 3 system description must contain. Most companies have never read it. Here is what each criterion requires and where descriptions most often fail.
Read the guideA SOC 2 audit can cost a modest five-figure fee or a mid six-figure engagement, and the difference is rarely about quality. Here is what actually moves the price, what a defensible engagement should cost, and why the cheapest quote is usually the most expensive decision.
Read the guideA nonconformity is a gap between what your ISMS says it does and what it actually does. Here is how they are classified, how to write a defensible corrective action plan, and how certification bodies verify closure.
Read the guideOne produces a certificate, the other an attestation report. Here is how they differ on scope, cost, geography, and timeline, and a clear rule for deciding which to pursue first.
Read the guideThe control matrix is the backbone of your compliance program. It ties every control to the criteria it satisfies, the evidence that proves it works, and the person responsible for keeping it working.
Read the guideClause 9.2 requires internal audits at planned intervals. Most companies underestimate what that means. Here is what a compliant, defensible internal audit program looks like in practice.
Read the guideThe readiness assessment is the least glamorous and most decisive step in SOC 2. Here is exactly what a gap analysis covers, the four deliverables you should expect, and why it controls the largest cost in the whole engagement.
Read the guideCompanies that sailed through SOC 2 in 2023 are getting qualified opinions in 2026. The audit did not change. The enforcement of what was always required did.
Read the guideCC6.4 requires restricting physical access to facilities and protected assets. What the criterion requires, how auditors test it across four infrastructure scenarios, the evidence checklist, and the exceptions that recur most.
Read the guideThe audit landscape has shifted. Here is what licensed CPA firms and certification bodies are scrutinizing in 2026, and what that means if your evidence was built on automation alone.
Read the guideMost companies describe themselves as "SOC 2 certified." That is technically wrong. Here is what SOC 2 actually is and why the distinction matters to sophisticated buyers.
Read the guideThe two documents at the center of every SOC 2 audit, what DC Section 200 and AT-C Section 205 actually require, and the inconsistencies that hand your auditor findings before fieldwork begins.
Read the guideA qualified opinion feels like a failing grade. It is not. What the four opinion types mean, why exceptions add up, and the root-cause, remediation, and re-test path back to a clean report.
ReadClause 9.2 requires an objective, impartial internal audit, not an in-house one. Why outsourcing is compliant, when it makes sense, and what a strong program covers.
ReadThe market prices readiness across a wide range. What actually drives the number, how to budget for readiness plus the audit plus remediation, and why the cheapest option rarely is.
ReadVanta, Drata, and Sprinto collect evidence but skip verification. The 40 to 60 percent of controls automation can't handle, and why a human verifier decides your opinion.
ReadAfter the scandal, a trust badge starts a conversation instead of ending one. Enterprise security teams ask who tested the evidence, what independence they held, and how effectiveness was confirmed across the period. Here is what an independent re-verification gives you.
ReadStrong teams stumble and mediocre ones sometimes sail through, because the difference is rarely the controls. It is whether you can prove they operated across the whole period. The five predictable failure points, and how a rescue fixes them before fieldwork.
ReadThe rubber-stamp era is over. Buyers vet harder, CPA firms scrutinize more, and a real audit is hard to pass on shortcuts. That is an advantage if you are the one who is ready. What readiness actually means now, and where to start.
ReadA Gap Sprint gives you an honest, fixed-scope picture of where you stand and a prioritized path to pass. Independent, senior-led, evidence you can defend.