What an Auditor Actually Does During a SOC 2 Type II Review
July 22, 2026 · ComplianceBase Editorial
Demystifying Type II fieldwork — samples, walkthroughs, exceptions, and why “we have a policy PDF” is not enough.
Blog
Framework updates, enforcement notes, and implementation writing. No email gate.
The $80K SOC 2 Surprise: What Founders Don't Budget For
July 10, 2026 · ComplianceBase Editorial
Auditor invoices are only part of the story. Here is how startups accidentally turn a $25K fee quote into an $80K year.
ISO 27001:2013 Certifications Are Dead — What the 2022 Transition Means for Your ISMS
June 26, 2026 · ComplianceBase Editorial
The 2022 edition restructured Annex A into four themes. Here is what SaaS teams should update in scope, SoA, and buyer language.
Annual Compliance Update 2026: A Framework and Evidence Review
June 18, 2026 · ComplianceBase Editorial
A practical 2026 review cycle for framework versions, regulatory sources, system scope, control evidence, vendor changes, and published compliance claims.
SOC 2 Common Criteria Changes: What the 2022 Points of Focus Update Actually Changed
June 12, 2026 · ComplianceBase Editorial
A practical read on the 2022 Revised Points of Focus for the 2017 Trust Services Criteria — what changed for SaaS evidence, and what did not.
HIPAA and SOC 2 Together: Building One Program for Two Different Goals
June 4, 2026 · ComplianceBase Editorial
How health technology companies can coordinate HIPAA safeguards and SOC 2 controls while preserving differences in law, scope, evidence, and assurance.
ISO 27001 Annex A.8.23: A Practical Guide to Web Filtering
May 21, 2026 · ComplianceBase Editorial
Understand ISO/IEC 27001:2022 Annex A.8.23 and build risk-based web filtering that supports users, remote work, monitoring, exceptions, and privacy.
An Engineer’s Guide to SOC 2 CC6.1
May 7, 2026 · ComplianceBase Editorial
Translate CC6.1 into practical identity, authorization, provisioning, authentication, service-account, and access-review engineering work.
Why Independent Compliance Education Matters
April 23, 2026 · ComplianceBase Editorial
How transparent sourcing, editorial independence, expert review, and clear boundaries make compliance guidance more trustworthy and useful.
SOC 2 for AI Companies: Scoping Systems, Models, Data, and Evidence
April 9, 2026 · ComplianceBase Editorial
A practical SOC 2 guide for AI companies covering system boundaries, model providers, training data, evaluations, access, change management, and incident response.
GDPR Enforcement Themes for 2025–2026: What Compliance Teams Should Watch
March 19, 2026 · ComplianceBase Editorial
A durable way to interpret recent GDPR enforcement themes across transparency, lawful basis, security, data rights, and cross-border processing.
Control Mapping Across SOC 2, ISO 27001, GDPR, and HIPAA
March 5, 2026 · ComplianceBase Editorial
A practical method for mapping shared security practices across four frameworks without pretending that similar requirements are interchangeable.