What an Auditor Actually Does During a SOC 2 Type II Review
July 22, 2026 · ComplianceBase Editorial
Demystifying Type II fieldwork — samples, walkthroughs, exceptions, and why “we have a policy PDF” is not enough.
Blog
Framework updates, enforcement notes, and implementation writing. No email gate.
The $80K SOC 2 Surprise: What Founders Don't Budget For
July 10, 2026 · ComplianceBase Editorial
Auditor invoices are only part of the story. Here is how startups accidentally turn a $25K fee quote into an $80K year.
ISO 27001:2013 Certifications Are Dead — What the 2022 Transition Means for Your ISMS
June 26, 2026 · ComplianceBase Editorial
The 2022 edition restructured Annex A into four themes. Here is what SaaS teams should update in scope, SoA, and buyer language.
SOC 2 Common Criteria Changes: What the 2022 Points of Focus Update Actually Changed
June 12, 2026 · ComplianceBase Editorial
A practical read on the 2022 Revised Points of Focus for the 2017 Trust Services Criteria — what changed for SaaS evidence, and what did not.