Compliance & Security,
Explained
Plain-English guides to the concepts behind ISO 27001, SOC 2, and the DPDP Act — written by certified auditors, not marketers. Start with the fundamentals below, or browse the full glossary.
A growing knowledge base · Last reviewed June 2026
Start with the fundamentals
What Is an ISMS?
Information Security Management System explained — the framework of policies, processes, and controls at the heart of ISO 27001.
Read the guideWhat Is GRC?
Governance, Risk & Compliance — the three pillars, why they belong together, and how they map to ISO 27001, SOC 2, and DPDP.
Read the guideRisk Management Frameworks
NIST RMF, ISO 31000, ISO 27005, COSO ERM, and FAIR — what each is for, and how to choose the right one.
Read the guideData Governance Frameworks
Managing data as an asset — DAMA-DMBOK, DCAM, and how data governance maps to the DPDP Act and GDPR.
Read the guideData Privacy Laws in India
The full landscape — the DPDP Act 2023, the DPDP Rules 2025, the legacy IT Act framework, and the RBI/SEBI/IRDAI overlays that sit on top.
Read the guideWhat Is a Data Fiduciary?
The DPDP Act’s equivalent of a data controller — how it differs from a data processor and a data principal, and what obligations it carries.
Read the guideDPDP Full Form & Meaning
DPDP = Digital Personal Data Protection. What the DPDP Act, 2023 is, who it applies to, and the key terms in plain English.
Read the guideWhat Is Access Control?
Who can access what — the models (DAC, MAC, RBAC, ABAC), least privilege, and its role in ISO 27001 & SOC 2.
Read the guideNIST Cybersecurity Framework
CSF 2.0 explained — the six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Tiers, Profiles, and how it maps to ISO 27001.
Read the guideInformation Security Policy
The top-level security document — what it must cover, the policy hierarchy, and why ISO 27001 Clause 5.2 requires one.
Read the guideCUECs & CSOCs Explained
The controls a SOC report assumes of you and of carved-out vendors — plus the carve-out vs inclusive method, in plain English.
Read the guideWhat Is AT-C Section 320?
The AICPA attestation section behind SOC 1 — the AT-C 105/205/320 architecture, the system-description elements, and management-defined control objectives.
Read the guideSSAE 18 vs SSAE 21
Which standard is current in 2026 — the SSAE 18→23 lineage with effective dates, and why SOC 1 still runs on AT-C 320.
Read the guideSOC 1 Description Criteria
Why SOC 1 has no DC 200 — the AICPA description criteria apply to SOC 2 only, while SOC 1’s requirements live inside AT-C 320.
Read the guideSOC 1 Bridge Letters
Gap letters between report periods — who signs them, what they must contain, and what they can never replace.
Read the guideCan an Indian CA Sign a SOC 2 Report?
Firm licensure, AICPA peer review, and why readiness and attestation must sit with different firms.
Read the guideCan You Get a SOC 2 from India?
Where the engineering happens versus who signs the opinion — and what a US vendor-risk team actually checks on the report.
Read the guideIs There a SOC 2 Certificate?
There is no SOC 2 certification body. What you may legitimately claim, and the wording that makes a reviewer discount you.
Read the guideOur Cloud Provider Has SOC 2 — Why Do We Need One?
The shared-responsibility split control by control, and the CUECs your provider’s own report assigns to you.
Read the guideCarve-Out vs Inclusive Method
How subservice organisations are described and tested — and what carving out does not let you avoid.
Read the guideSOC 2 Scope and the System Boundary
What may legitimately be excluded from scope, and the DC 200 test that stops a boundary drawn to flatter the vendor.
Read the guideChoosing Your Trust Services Criteria
Security is mandatory. The other four follow the commitments you actually made — and Privacy is far more work than teams expect.
Read the guideSOC 2 Auditor Independence
Why the firm that designs your controls cannot attest to them, and exactly where the permitted line falls.
Read the guideA Security Incident During Your Observation Period
An incident does not automatically qualify the opinion. What turns one into an exception, and what the auditor asks for.
Read the guideSOC 2 and Penetration Testing
No criterion mandates a pen test — your own control description does. Timing, scope, and what evidence gets rejected.
Read the guideIs a SOC 2 Report Confidential?
Restricted-use language, NDAs, trust portals and SOC 3 — plus what to send when a prospect refuses to sign.
Read the guideDoes SOC 2 Replace Security Questionnaires?
What the report answers, what it was never scoped to answer, and how to use it to compress a questionnaire.
Read the guideDR and Backup Testing for SOC 2
Why a tabletop may not satisfy a control promising technical restoration, and the evidence package auditors request.
Read the guideSOC 2 With a Small Team
Segregation of duties when the founder approves their own access — the compensating controls that actually pass.
Read the guideDo All Your Vendors Need SOC 2?
Risk-based vendor tiering, and what to do when a critical vendor has neither SOC 2 nor ISO 27001.
Read the guideDoes a SOC 2 Report Mean You Are Secure?
Reasonable versus absolute assurance — why a clean opinion is not an absence of risk, and what the report legitimately evidences.
Read the guideDoes SOC 2 Make You GDPR, DPDP or HIPAA Compliant?
What SOC 2 genuinely supports in each regime, and the obligations — lawful basis, rights, BAAs, breach timelines — it never touches.
Read the guideSOC 2 or ISO 27001 First?
A sequencing decision keyed to buyer geography and which deal is blocked, plus what control work genuinely transfers.
Read the guideConfidentiality vs Privacy in SOC 2
Processing personal data does not automatically require the Privacy category. The contractual triggers that actually do.
Read the guideSOC 2 Sampling, Populations and Deviations
How populations are defined, why completeness is tested first, and how a single deviation is evaluated.
Read the guideChanges During Your Observation Period
New modules, IdP migrations and adding a category mid-window — what is absorbable and what is not.
Read the guideScoping One Product When You Have Five
When a scoped system is genuinely separable, and when shared infrastructure makes the boundary misleading.
Read the guideSOC 2 Evidence: What Auditors Actually Accept
Why screenshots are weak evidence, what a defensible artefact contains, and the rejections that cost weeks.
Read the guideMoving from SOC 2 Type 1 to Type 2
What changes when design testing becomes operating-effectiveness testing, and when the window should start.
Read the guideThe Management Assertion (Section 2)
Your statement, not the auditor’s — what signing it commits you to, clause by clause.
Read the guideWhat SOC 2 Readiness Actually Involves
What it produces, what it is not, and why the readiness firm generally should not also sign the opinion.
Read the guideContinuous Monitoring and Year-Round Evidence
Why SOC 2 fails in the last four weeks, and how to design controls that generate their own evidence.
Read the guideYour Second SOC 2: What Changes in Year Two
Period sequencing, prior-year exceptions, changing auditor, and the year-two complacency failure.
Read the guideWriting the SOC 2 System Description
The omit-or-distort standard, writing at the right altitude, and a CUEC section that is honest rather than a liability dump.
Read the guideWho Actually Runs Each SOC 2 Control
The controls that fall between teams and get dropped — offboarding, vendor reviews, orphaned access reviews.
Read the guideHow Long Is a SOC 2 Report Valid?
No AICPA rule makes a SOC 2 report expire — buyers decide. The freshness ladder they apply, and why a short observation period ages faster.
Read the guideSOC 2 Bridge Letters
Your management signs it, not the CPA firm. What it can credibly say, the three-month practical limit, and the phrasings that overstate assurance.
Read the guideSOC 2 Observation Period
Three, six or twelve months? No AICPA minimum exists — why short windows leave quarterly and annual controls with no testable population.
Read the guideWhat Is SOC 2?
The AICPA attestation for service organizations — the five Trust Services Categories, Type 1 vs Type 2, and what "SOC 2 compliant" really means.
Read the guideHow to Read a SOC 2 Report
The five sections explained — auditor’s opinion, management’s assertion, system description, test results — plus the red flags reviewers check first.
Read the guideSOC 2 Opinions & Exceptions
Unmodified, qualified, adverse, disclaimer — what each auditor opinion means, how test exceptions differ, and how to respond to both.
Read the guideWho Can Perform a SOC 2 Audit?
Only a licensed CPA firm can issue a SOC 2 report — what that means, how independence works, and where consultants and platforms fit.
Read the guideSubservice Organizations
Carve-out vs inclusive method — how your vendors’ vendors appear in a SOC report, and the monitoring you inherit.
Read the guideSOC 2 Controls List
There is no official list — illustrative controls by criteria series (CC1–CC9 and beyond), and how to design your own set.
Read the guideSOC 2 Compliance Checklist
Six phases from first scoping call to annual maintenance — with the concrete checkpoints auditors expect at each.
Read the guideTypes of SOC Reports
SOC 1 vs SOC 2 vs SOC 3 — audiences, criteria, restricted vs general use, and which report your customers are actually asking for.
Read the guideYour SOC 2 Is In Progress — What to Tell Customers
What you can honestly claim mid-journey — readiness letters, timeline language, and questionnaire answers that hold up.
Read the guideSOC 2 for Enterprise Sales
How a report actually moves security reviews and procurement — and the deals it won’t close on its own.
Read the guideAnatomy of a SOC 2 Report (Interactive)
A SOC 2 Type II report you can dissect — 18 clickable markers explain the opinion, assertion, description, and test matrix.
Read the guideSOC 2 Common Pitfalls
The ten predictable mistakes that stall first examinations — scoping, operating-period, and fieldwork — and what to do instead.
Read the guideAI Risk vs AI Impact Assessment
The most-confused distinction in ISO 42001 — clause 6.1.2 risk (inward) vs 6.1.4 impact (outward, per ISO/IEC 42005), and how both feed the SoA.
Read the guideWhich AI Role Are You?
Provider, deployer, producer, user — and the four scenarios: API wrappers, fine-tuners, self-hosters, and internal-only AI use.
Read the guideISO 42001 + ISO 27001 Integration
One integrated system, two certificates — what your ISMS already gives you, the genuinely new AIMS artifacts, and combined audits.
Read the guideISO 42001 Accreditation & ISO 42006
Not all certificates are equal — accredited vs unaccredited, ISO/IEC 42006:2025, and the 30-minute IAF CertSearch verification.
Read the guideISO 42001 vs the EU AI Act
Voluntary standard vs binding law — the post-omnibus timeline (Annex III from Dec 2027), what an AIMS evidences, and what it can’t.
Read the guideISO 42001 vs NIST AI RMF
GOVERN, MAP, MEASURE, MANAGE crosswalked to clauses and controls — and the certifiability difference that decides adoption.
Read the guideWhy SOC 2 Quotes Vary
Two companies bill you, three audit routes exist, and published figures assume the US market — the 10x spread, decoded in USD.
Read the guideDo You Need SOC 2 Software?
An honest decision guide: when a compliance platform is worth it, when it is optional, and when it is pure overhead.
Read the guideWhat SOC 2 Automation Actually Automates
Evidence collection, yes. Scoping, risk assessment, control design and auditor judgement — still human, task by task.
Read the guideSOC 2 for Startups: Consultant vs Platform
Under roughly 50 people the equation flips. Compared at 10, 25 and 50 headcount — in cash and in founder hours.
Read the guideSOC 2 Requirements: Mandated vs Vendor-Added
What the AICPA actually requires — and what is convention, buyer expectation, or vendor packaging.
Read the guideWhy Platforms Charge a Platform Fee
What the subscription funds, why the attestation was never inside it, and what the same dollars buy elsewhere.
Read the guideWhen a Platform Costs More Than It Saves
The overhead inventory for a small single-framework team — and the break-even point where it stops being overhead.
Read the guideSOC 2 Without a Compliance Platform
The no-software route end to end: what replaces each platform function, and what it honestly demands of you.
Read the guideCompliance Platform vs Consultant
Not software vs no software — who does the work, stage by stage, with the hybrid pattern treated fairly.
Read the guideSOC 2 Total Cost of Ownership
Year one is the smallest number you will pay. The three-year ledger for every route, and what changes at renewal.
Read the guideLooking for a specific term? The compliance glossary defines the acronyms and concepts across ISO 27001, SOC 2, DPDP, HIPAA, and more — and more in-depth guides are on the way.
CERT-In, VAPT and safe-to-host audits
We deliver CERT-In audits, end to end, with our CERT-In empanelled partners. See how a CERT-In audit runs with us.
What CERT-In Is
Section 70B, the 2013 Rules, the 2022 Directions and the 2025 audit policy guidelines — what the national agency does, what it empanels others to do, and what it never does.
Read the guideThe CERT-In Directions of April 2022, Explained
Six directions, who they bind, and what each one requires in practice — read from the CERT-In instrument itself, not from the summaries of it.
Read the guideCERT-In Empanelment: What It Means and What It Does Not
Declared manpower, the NOC rule, report sharing with CERT-In within 5 days, quarterly returns, and the single sentence an empanelled auditor is permitted to use about CERT-In.
Read the guideWhat a CERT-In Empanelled Auditor May and May Not Do
No DDoS or flood testing over the Internet without your explicit written permission. Written approval before tools go on. Your data stays in India. Three signatures on the report. The rules of engagement, from CERT-In’s own guidelines.
Read the guideHow to Verify a CERT-In Audit Certificate Is Genuine
CERT-In publishes a list of empanelled organisations, not a register of certificates. The thirteen-step check, the clause behind every requirement, and what a forged or overstated certificate looks like.
Read the guideAMBAK: CERT-In’s Audit Monitoring Platform
What AMBAK stands for, what CERT-In actually published about it, and how to check that an Indian security audit certificate is genuine — the empanelment check, the certificate fields, and the request to send the issuer.
Read the guideCERT-In SAMVAAD 2026
What CERT-In launched at SAMVAAD 2026, what its working groups are building, and where Indian audit scope is heading — AI red teaming, cloud, APIs, OT and the BOM family.
Read the guideWhat a Safe-to-Host Certificate Is
GIGW guideline 5.3.1 in full, the four named issuers, certificate versus audit report, and what the signing auditor tests against.
Read the guideHow to Get a Safe-to-Host Certificate
Eleven stages, the paperwork gate before testing can start, the staging-server rule that reshapes your release plan, and the retest that actually issues the certificate.
Read the guideWho Can Issue a Safe-to-Host Certificate
CERT-In, STQC or NIC — the three eligible routes, where the published register lives, the exact wording an empanelled auditor may use, and the checks to run before you award.
Read the guideSafe-to-Host vs Security Audit Certificate vs VAPT Report
Indian tenders use these names interchangeably. They are not the same thing. A decision table for reading an ambiguous clause, and the clarifying question to ask the buyer.
Read the guideHow Long a Safe-to-Host Certificate Stays Valid
One year from the date of issue, or the next change to the audited build — whichever is earlier. Two clocks, one certificate, and a release calendar that has to respect both.
Read the guideWhy Applications Fail a Safe-to-Host Audit
The failure catalogue, organised by what the findings are rather than by tool output — with the retest evidence that actually closes each one.
Read the guideGIGW Compliance Before Go-Live
What GIGW 3.0 requires before a government website or app is hosted in production — the security statement, who may issue the clearance, and the evidence pack behind it.
Read the guideWhat VAPT Actually Is
Vulnerability assessment is breadth and enumeration. Penetration testing is depth and exploitation. CERT-In defines them as two things, says solely tools-based testing should be discouraged, and says the OWASP Top 10 is not an audit standard.
Read the guideThe Types of VAPT
Web application, external and internal network, mobile, API, cloud configuration, wireless, endpoint, OT and ICS, and IoT — what each covers, what it provably cannot find, and the combinations that leave a real gap.
Read the guideVAPT, Penetration Testing and Red Teaming Are Not the Same Engagement
A pentest answers what is exploitable here. A red team answers would we detect and respond. A scan answers neither. How to tell which one a quote is actually offering.
Read the guideScoping a VAPT So the Result Means Something
A clean report on the wrong system is a true statement about nothing. Derive the scope from the asset inventory, name the environment, fix the build, cover the roles, write down every exclusion — and get the rules of engagement in writing first.
Read the guideHow to Read a VAPT Report
Scope, environment, dates, evidence, severity and closure — read in the order that tells you whether the test was real.
Read the guideRetesting and Closure
A screenshot of a settings screen is not closure evidence. What is — finding class by finding class — plus retest scope, partial closure, risk acceptance, and who pays for the retest.
Read the guideWhat AI Red Teaming Is
Adversarial testing of an AI system, not of the servers under it and not of the model in isolation. Prompt injection, excessive agency, data extraction, insecure output handling — and the reproduction rate that makes a non-deterministic finding reportable.
Read the guideAI Red Teaming and VAPT Are Different Engagements
Passing a penetration test says nothing about whether your assistant can be talked into calling a tool it should not. Determinism versus stochasticity, and what that does to reproduction, severity and retest.
Read the guideRed Teaming an LLM Application, Step by Step
Scope the model, the system prompt, the corpus, the tools, the identity and the humans. Then test injection, extraction, leakage, excessive agency and insecure output handling — and report reproduction rate, not a screenshot.
Read the guideAI and ML Incidents Are Already Reportable to CERT-In
No new instrument is required. Annexure I item (xx) of the 2022 Directions puts AI and ML incidents inside the six-hour reporting regime, and the 180-day log obligation is what makes filing possible at all.
Read the guideWhat Cloud Security Actually Covers
The provider secures the cloud and you secure what you put in it. Identity, network, data, workload and the management plane, plus the six-hour reporting duty and the 180-day log duty.
Read the guideCloud Security Audit in India
What a cloud security audit covers, what an empanelled auditor can and cannot test, how to grant read-only assessment access properly, and how closure is demonstrated when the fix is a policy change rather than a patch.
Read the guideAPI Security Testing
Authentication and tokens, object and function level authorisation, mass assignment, resource consumption, input validation, error handling, and the versioned endpoints still serving traffic. Plus the discovery problem nobody prices.
Read the guideGoverning AI systems and agents
The Ten Questions That Govern Any AI Agent
Purpose, owner, data, capability, identity, oversight, detection, evidence, reassessment, stop. Good answers, bad answers, and the artefact each question produces.
Read the guideWhen a Tool Becomes an AI Agent
Reach, consequence and mediation decide the tier. The product name decides nothing. A capability-tier table, a decision tree, and what an assessor actually asks for.
Read the guideAI System and Agent Inventory
A scanner finds agents. It cannot find owners, intended use, or what an acceptable failure looks like. The fields, the enumeration paths and the evidence.
Read the guideAI Agent Identity and Delegated Authority
Holding an authority and holding the authority to delegate it to software are different permissions. Five identity patterns, the fifteen-field action record, and the leaver who took the agent with her.
Read the guideKill Switches and Circuit Breakers for AI Agents
Halt in flight, disable the trigger, revoke the credential, remove the tool, prevent further effects. The ladder, the breakers, the handover, and the runbook.
Read the guideAI Agent Monitoring and Audit Logs
Why the transcript is the wrong record, what an investigator needs instead, and the evidence an assessor asks for when an agent works unattended.
Read the guideAI Agent Spending and Transaction Limits
Three hundred and eighteen payments in eighty-six minutes, every one of them under the limit. The control set that actually works for agents that transact.
Read the guideAI Code Provenance and Licensing
What public-code filters miss, why the dependency beats the snippet, the provenance record model, and the indemnity conditions nobody reads until they need them.
Read the guideAI Competence and Training Obligations
Role-versus-competence mapping, a verification-threshold model, and the training evidence an ISO 42001 certification body actually asks for.
Read the guideReviewing AI-Generated Code
One definition of secure, not two. The four AI-specific checks, the pipeline additions, and the metrics that reveal whether your review gate is real or ceremonial.
Read the guideGoverning Hundreds of Agents
A control is inherited only if the agent could not have been created without it. Everything else is owed per agent. The classes, the drift signals, the sampling design.
Read the guideWhat Counts as an AI Incident?
Not every hallucination is a ticket, and not every ticket is an AI incident. The contribution test, the taxonomy, the record schema, and the trending that turns incidents into evidence.
Read the guideAI Model Change Management
A four-axis material-change test, a ten-row change-trigger matrix, a seven-class regression model, and the evidence an ISO 42001 assessor or CPA firm actually asks for.
Read the guideAI Supplier Due Diligence
What each artefact proves and what it cannot, the stack behind the vendor, the AI-specific contract terms, and the eleven triggers that should reopen the file.
Read the guideVendor Approval Is Not Use-Case Approval
The single most common AI governance error, and the two-tier approval design that fixes it without putting a queue in front of everyday work.
Read the guideGoverning Coding Agents
One framework for Claude Code, Cursor and Copilot — the capability graph, the permission boundary table, and the evidence an auditor asks for.
Read the guideCoding Agents and Production Access
The agent proposes, the pipeline gates, a human approves. The rights matrix, the worked pipeline, the break-glass rules, and what the auditor samples.
Read the guideCoding Agents and Secrets
The agent almost never needs the secret. It needs the capability the secret unlocks. Escape paths, the control hierarchy, rotate-first response, and the evidence that makes it testable.
Read the guideCopilot Oversharing and Permission Hygiene
“It only shows what users can already access” is true and misleading. The surfaces that accumulate the debt, the admin paths and cmdlets to run, and the populations an examiner samples.
Read the guideConnectors and the Permission Inheritance Problem
Data access entitlement is not authorisation for a particular AI purpose. A proportionate connector assessment, five identity models, and what to re-review when a connector changes.
Read the guideHuman-in-the-Loop That Actually Means Something
Which actions require review, what the reviewer checks, what competence they need, what happens on refusal — and how to evidence that oversight genuinely operated.
Read the guideMCP Server Security and Governance
OAuth proves who is connecting. It says nothing about least privilege, prompt-injection resistance, or whether this server should exist in your estate at all.
Read the guideApproving MCP Tools and Capability Change
Not every tool needs its own approval — but every tool needs a class. Eight action classes, nine change triggers, and the evidence an assessor asks for.
Read the guidePrompt Injection and Tool Calls
The model does not have to be wrong for the outcome to be wrong. It only has to be useful, and pointed at the wrong instruction.
Read the guideShadow AI and Personal Accounts
Why punishing shadow AI fails, the what-is-lost table, detection ranked by privacy cost, enforceable policy language, and the first hour after a disclosure.
Read the guide