How do I prepare for SOC 2?

Prepare for SOC 2 by choosing your report type and Trust Services Criteria, scoping your system, implementing the core controls (access, change management, monitoring, vendor management, incident response), collecting evidence continuously, running a readiness assessment to close gaps, and then engaging a licensed CPA firm for the audit.

What evidence is required for SOC 2?

SOC 2 evidence is the proof that your controls operate: security policies, access-control and access-review records, change-management tickets, monitoring and logging output, vendor-management records, incident-response records, and onboarding/offboarding and training records, each tied to the control it supports and kept fresh across the audit period.

How can a startup get SOC 2 fast?

A startup gets SOC 2 fastest by keeping scope tight (start with only the required Security criterion), turning on continuous evidence collection from day one, closing gaps with a readiness assessment before an auditor ever looks, and choosing the report sequence that matches its buyers: a Type I to show progress in weeks, then a Type II over a short observation window (commonly three months). The audit itself must be performed by a licensed CPA firm; there is no way to skip the observation window for Type II, but the readiness work in front of it can be compressed from months to weeks.

How long does ISO 27001 take?

For most SMBs, ISO 27001 certification takes roughly 3 to 9 months from a standing start: a few weeks to months to build the ISMS, run a risk assessment, and implement controls, then the certification body’s Stage 1 and Stage 2 audits. Companies with an existing security program (or a SOC 2) can move faster.

What policies are required for ISO 27001?

ISO 27001 requires a top-level information security policy, plus supporting policies driven by your risk assessment and Statement of Applicability, commonly covering access control, acceptable use, cryptography, supplier/vendor security, incident management, business continuity, secure development, HR security, and data classification and handling.

How much does compliance software cost?

Compliance (GRC) software ranges widely: legacy enterprise platforms often run tens of thousands of dollars a year, while modern SMB-focused tools are far more affordable. Price usually scales with the number of frameworks, users, and automation. Separately, the SOC 2 or ISO 27001 audit itself is an additional cost paid to an auditor.

What is the best compliance software for a small business?

The best compliance software for a small business is one that is affordable, fast to implement, covers the frameworks you need on one control set, automates evidence collection, and does not require a dedicated compliance team. Evaluate on price, framework coverage, crosswalking, automation, and self-serve setup. Keel is built specifically for this profile.

What is the best GRC software for MSPs?

The best GRC software for an MSP manages many client workspaces from one console, supports white-labeling, prices per client rather than per enterprise seat, and crosswalks one control set across frameworks so work is reused across clients. Evaluate on multi-tenancy, white-label, partner pricing, and automation. Keel offers a dedicated MSP/partner track.

How do I build a risk register?

Build a risk register by identifying risks from real sources, describing each clearly, scoring inherent likelihood and impact on a consistent scale, assigning an owner and a treatment, linking the controls that reduce each risk and scoring residual likelihood and impact, and reviewing it on a cadence so it stays current.

What is the difference between SOC 2 Type I and Type II?

A SOC 2 Type I report evaluates whether your controls are suitably designed at a single point in time. A Type II goes further and tests whether those controls actually operated effectively over a period, commonly 3 to 12 months. Type II is the report most enterprise customers ask for, because it shows controls work over time, not just on paper on one day.

Do I need SOC 2 or ISO 27001?

Both demonstrate strong information security, but they differ in form and audience. SOC 2 is a US attestation report (from a CPA firm) that customers read, common with North American buyers. ISO/IEC 27001 is an international certification of a management system (an ISMS), recognized globally. Choose based on where your customers are and what they ask for; many companies eventually do both, and the underlying controls overlap heavily.

What is the difference between SOC 1 and SOC 2?

SOC 1 and SOC 2 are both AICPA attestation reports, but they cover different things. SOC 1 covers controls at a service organization that are relevant to its customers financial reporting (ICFR). SOC 2 covers controls relevant to security and the other Trust Services Criteria (availability, processing integrity, confidentiality, and privacy). If customers care about how you affect their financial statements, that is SOC 1; if they care about how you protect their data, that is SOC 2.

What is a SOC 2 bridge letter?

A bridge letter (or gap letter) is a short letter from a service organization that covers the gap between the end of its SOC 2 report period and a later date, often a customer reliance date. It states that, to management knowledge, no material changes to the control environment occurred in that interim period. It is written by the service organization, not the auditor, and it does not extend the audit or provide new assurance.

How often do I need a penetration test?

There is no single universal rule, but the widely accepted practice is at least once a year and after any significant change to your systems or applications. Some frameworks are explicit: PCI DSS requires penetration testing at least annually and after significant changes. SOC 2 and ISO 27001 do not mandate a fixed frequency, but auditors expect regular testing, and annual is the norm.

What is a SOC 2 readiness assessment?

A SOC 2 readiness assessment is a gap analysis you do before the formal audit: you compare your current controls and evidence against the Trust Services Criteria and identify what is missing or weak, so you can fix it before an auditor evaluates you. It is not the audit itself and produces no report customers can rely on; it is the preparation that makes the real audit go smoothly.

What is a business associate agreement (BAA)?

A business associate agreement (BAA) is a contract required by HIPAA between a covered entity (or a business associate) and a vendor that will create, receive, maintain, or transmit protected health information (PHI) on its behalf. It sets out how the business associate will safeguard PHI and its breach-notification duties. You must have a signed BAA in place before sharing PHI with that vendor.

Does my startup need to be HIPAA compliant?

You need to comply with HIPAA if you are a covered entity (a health plan, healthcare clearinghouse, or a healthcare provider that transmits health information electronically) or a business associate (a vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity). If your product handles PHI for a covered entity, you are a business associate and HIPAA applies to you.

What is a data processing agreement (DPA)?

A data processing agreement (DPA) is a contract, required under GDPR Article 28, between a data controller and a data processor that processes personal data on the controller’s behalf. It sets out the scope, purpose, and duration of processing, the processor’s security obligations, its use of sub-processors, and how it assists the controller with data-subject rights and breach notification.

Do I need to comply with GDPR if I am a US company?

Possibly yes. GDPR applies to organizations outside the EU/EEA when they offer goods or services to, or monitor the behavior of, people in the EU/EEA, regardless of where the company is based. So a US company with EU customers, or that tracks EU website visitors, can fall under GDPR.

Can I show ads in a kids app, and which ad SDK can I use?

Sometimes — but on different terms in each store, and there is no single ad configuration that ships on all three. Apple permits third-party advertising in the Kids Category only where it is contextual and the ad provider publicly documents Kids Category practices that include human review of ad creatives. Google Play permits ads to children or users of unknown age only from a Families Self-Certified Ads SDK version, with no interest-based advertising and no remarketing. Amazon bars its own Amazon Advertising and Associates programmes from child-directed apps and areas outright, and parental consent does not lift that — which makes Amazon the binding constraint. COPPA is US law; these three are store contracts, and complying with COPPA satisfies none of them.

Does COPPA apply to my app if it is not aimed at children?

It can, yes. COPPA has two independent triggers and only one of them is about who your app is aimed at. The Rule binds an operator of a website or online service directed to children under 13, and — separately — any operator with actual knowledge that it is collecting or maintaining personal information from a child. The second prong does not consider your target audience at all: once you actually know a particular user is under 13, you are inside the Rule for that user, however grown-up your product is. Deciding you are a general-audience app is therefore a decision about the first trigger only, and it does not dispose of the second. The app-store children’s policies ask a different question again, and Amazon in particular treats a mixed-audience app as child-directed by default unless the developer confirms children are not using it.

What happens if my kids app collects an advertising ID?

Under COPPA a persistent identifier is personal information, but there is a narrow exception: collecting a persistent identifier and no other personal information, used for the sole purpose of supporting the internal operations of the service, with a notice describing exactly which internal operations and how the identifier is kept from being used to contact or profile anyone. That exception is a COPPA exception only. Google Play is stricter and structural — an app that solely targets children must not transmit the Android advertising identifier at all, and must not declare the AD_ID permission when targeting API level 33 or above, which is visible in your manifest whether or not you ever read the identifier. In a mixed-audience app the same transmission ban covers children and users whose age is unknown. Apple bars sending device information to third parties from a Kids Category app, even from sections intended for adults. So satisfying the COPPA exception does not clear you to ship.

Do I need a parental gate, an age screen, or parental consent?

Probably more than one of them, because they are three different mechanisms doing three different jobs and satisfying one does not satisfy the others. A parental gate is an Apple requirement: a Kids Category app must put links out of the app, purchasing opportunities and other distractions behind one, and Apple specifies the gate itself as an adult-level task that must be completed before the user may continue. A neutral age screen is what Google Play and Amazon ask for, and its job is different — it establishes the age signal that lets the identifier, SDK and ads rules be applied to the right users. Verifiable parental consent is what COPPA requires before collecting a child’s personal information, and it is a legal mechanism with recognised methods. Apple says directly that a parental gate is generally not the verifiable parental consent those privacy statutes require.

How do I do a vendor security assessment?

A vendor security assessment checks whether a third party protects the data you would share with it. Tier the vendor by the data and access it needs, gather evidence (a SOC 2 report, an ISO 27001 certificate, or a completed security questionnaire), review the gaps, record a risk rating with an owner and a decision, and set a re-assessment date so it happens on a cadence.

How do I read a SOC 2 report?

A SOC 2 report has a few key parts: the independent auditor’s opinion, management’s assertion, the system description, and the tests of controls with their results. When you review a vendor’s report, check the report type and period, which Trust Services Criteria are in scope, whether the auditor’s opinion is unqualified, and any exceptions noted in the test results.

How do I choose a SOC 2 auditor?

A SOC 2 audit must be performed by a licensed CPA firm, so start by confirming the firm is a licensed CPA. Then weigh experience with companies your size and industry, whether they work smoothly with your evidence platform, price and timeline, independence, and references. Do a readiness assessment first so you engage the auditor with gaps already closed.

What does a SOC 2 audit cost?

Published vendor estimates put a SOC 2 Type I audit roughly in the $5,000 to $20,000 range and a Type II from about $7,000 into six figures depending on scope, with small companies commonly at the lower end. The audit fee is only part of the total: readiness work, a penetration test, tooling, and internal time usually make the all-in first-year cost larger than the auditor invoice.

Is SOC 2 required by law?

No. SOC 2 is a voluntary attestation developed by the AICPA, not a law or a government mandate. Companies pursue it because customers require it in contracts and security reviews, not because a statute compels it. That is different from HIPAA, PCI DSS, or GDPR, which are legal or contractual obligations tied to specific data.

How do I answer a security questionnaire?

Answer a security questionnaire from a maintained library of reviewed answers tied to your real controls and evidence, map incoming questions to those answers instead of rewriting each time, point to your trust center and reports (like SOC 2) where you can, have a knowledgeable owner review before sending, and never overstate what you actually do.

What is a penetration test report?

A penetration test report is the deliverable from a pen test: it documents the scope and methodology, lists the vulnerabilities found with a severity rating and evidence for each, gives remediation guidance, and often records a retest confirming fixes. Buyers and auditors ask for it as proof you actively test your security, not just scan.

ISO 42001 is voluntary, so no law requires it. You are a candidate for it if you build or deploy AI and your buyers, partners, or regulators are starting to ask how you govern AI, or if you want a certifiable way to show responsible-AI practices. If AI is not core to your product, or no one is asking yet, it can wait.

ISO 42001 vs the NIST AI RMF: what is the difference?

ISO/IEC 42001 is a certifiable management-system standard for AI (an AIMS), while the NIST AI Risk Management Framework is a voluntary US framework of functions and categories for managing AI risk. Neither is a law. Many teams use the NIST AI RMF as their working method and ISO 42001 as the certifiable system around it.

How do I prepare for the EU AI Act?

Prepare for the EU AI Act by inventorying the AI systems you build or use, classifying each by the Act’s risk tiers, and then meeting the obligations for that tier: avoid prohibited practices, implement the high-risk requirements (risk management, data governance, documentation, human oversight) where they apply, meet transparency duties, and track the staged application dates.

What are the PCI DSS requirements?

PCI DSS 4.0.1 has 12 requirements grouped under 6 goals, and they apply to any organization that stores, processes, or transmits payment card data. The goals are: build and maintain a secure network and systems, protect account data, maintain a vulnerability management program, implement strong access control, regularly monitor and test networks, and maintain an information security policy.

Does my SaaS need to be PCI DSS compliant?

If your SaaS stores, processes, or transmits cardholder data — or can affect the security of the systems that do — PCI DSS applies. Most SaaS keep scope small by fully outsourcing payments to a PCI-compliant processor (for example, a hosted checkout) so card data never touches their servers, which can reduce validation to the shortest self-assessment (SAQ A). You still have obligations, just far fewer.

What does ISO 9001 certification require?

ISO 9001:2015 requires a documented Quality Management System (QMS) that meets the standard’s clauses 4 to 10: understand your context and interested parties, show leadership with a quality policy, plan around risks and quality objectives, provide resources and competence, control your operations, evaluate performance through internal audits and management review, and drive continual improvement. An accredited certification body then audits it in two stages.

What is the NIST Cybersecurity Framework (CSF)?

The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, public-domain framework that organizes cybersecurity into six functions — Govern, Identify, Protect, Detect, Respond, and Recover — each broken into categories and subcategories of outcomes. It is a common language for managing cyber risk and a popular on-ramp before a formal audit. There is no NIST CSF certification.

How do I migrate from Vanta or Drata to Keel?

You can move your program to Keel with keel-migrate, our open-source tool: export your vendors, risks, people, policies, and the actual policy and evidence document files from Vanta or Drata into an open format, then import them into Keel. Large exports are split across files automatically, and a OneTrust source is in beta.

What is a trust center and how do I publish one?

A trust center is a public web page that shows your security posture — your frameworks and certifications, key controls, subprocessors, and updates — so prospects and customers can self-serve security due diligence instead of emailing you a questionnaire. In Keel you publish one from your existing program: choose what to show across a multi-tab trust center (overview, resources, controls, subprocessors, updates) and post updates as your posture changes.

Is ISO 26000 certifiable?

ISO 26000:2010 is guidance on social responsibility, not a management system standard. It contains no requirements, so no organization can be certified against it and no audit can find it compliant.

Answers

Straight answers to common GRC questions

The questions teams actually ask when they start a compliance program, answered directly and then in depth, so you can act instead of guess.

SOC 2

How do I prepare for SOC 2?
Prepare for SOC 2 by choosing your report type and Trust Services Criteria, scoping your system, implementing the core controls (a…
What evidence is required for SOC 2?
SOC 2 evidence is the proof that your controls operate: security policies, access-control and access-review records, change-manage…
How can a startup get SOC 2 fast?
A startup gets SOC 2 fastest by keeping scope tight (start with only the required Security criterion), turning on continuous evide…
What is the difference between SOC 2 Type I and Type II?
A SOC 2 Type I report evaluates whether your controls are suitably designed at a single point in time. A Type II goes further and …
Do I need SOC 2 or ISO 27001?
Both demonstrate strong information security, but they differ in form and audience. SOC 2 is a US attestation report (from a CPA f…
What is the difference between SOC 1 and SOC 2?
SOC 1 and SOC 2 are both AICPA attestation reports, but they cover different things. SOC 1 covers controls at a service organizati…
What is a SOC 2 bridge letter?
A bridge letter (or gap letter) is a short letter from a service organization that covers the gap between the end of its SOC 2 rep…
What is a SOC 2 readiness assessment?
A SOC 2 readiness assessment is a gap analysis you do before the formal audit: you compare your current controls and evidence agai…
How do I read a SOC 2 report?
A SOC 2 report has a few key parts: the independent auditor’s opinion, management’s assertion, the system description, and the tes…
How do I choose a SOC 2 auditor?
A SOC 2 audit must be performed by a licensed CPA firm, so start by confirming the firm is a licensed CPA. Then weigh experience w…
What does a SOC 2 audit cost?
Published vendor estimates put a SOC 2 Type I audit roughly in the $5,000 to $20,000 range and a Type II from about $7,000 into si…
Is SOC 2 required by law?
No. SOC 2 is a voluntary attestation developed by the AICPA, not a law or a government mandate. Companies pursue it because custom…

ISO 27001

PCI DSS

NIST CSF

What is the NIST Cybersecurity Framework (CSF)?
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, public-domain framework that organizes cybersecurity into six functions…

ISO 9001

What does ISO 9001 certification require?
ISO 9001:2015 requires a documented Quality Management System (QMS) that meets the standard’s clauses 4 to 10: understand your con…

HIPAA & privacy

Children’s privacy

AI governance

ESG & Sustainability

Is ISO 26000 certifiable?
ISO 26000:2010 is guidance on social responsibility, not a management system standard. It contains no requirements, so no organiza…

Trust Center

What is a trust center and how do I publish one?
A trust center is a public web page that shows your security posture — your frameworks and certifications, key controls, subproces…