.svg)
SOC 2SOC 2 ImplementationSOC 2 On-PremSOC 2 Bare-MetalRisk Management
SOC 2 Change Management with Tickets Instead of CI/CD
TL;DR
- Change management maps to CC8.1, which has 14 Points of Focus covering authorization, design, testing, approval, deployment, segregation of...
SOC 2 Secure Development with Self-Hosted GitLab
TL;DR
- The same Trust Services Criterion that governs infrastructure changes governs code changes: CC8.1, change management
- Self-hosted GitLab is the...
Consulting as Code: Running Cybersecurity on GitHub
For years, programmers had an unfair advantage over the rest of us.
Not because they could build software. Because they could access data. Rich,...
The Real Cost of DIY Compliance vs. Hiring a Consultant
On paper, DIY compliance looks straightforward. Subscribe to a GRC platform, follow the control library, collect evidence, engage an auditor. The...
SOC 2 Consultants for On-Prem and Hybrid Infrastructure
Most SOC 2 consultants know AWS. Some know Azure and GCP. Very few know what to do when your stack includes a colocation facility, a bare-metal fleet...
ISO 42001 Certification Cost: What You'll Actually Pay in 2026
If you are an AI SaaS company looking at ISO 42001, the first question is not what does the standard say. It is what is this going to cost us in...
SOC 2 in 90 Days: What That Timeline Actually Requires
Ninety days from kickoff to a SOC 2 readiness is achievable. It is not achievable for every company, and the companies that hit it make deliberate...
SOC 2 for Professional Services Firms: The Scoping Problem Nobody Warns You About
A professional services firm starts its SOC 2 process the same way most companies do. An enterprise client puts it in an RFP. The team subscribes to...
Fractional CISO for SaaS Companies: What the Role Actually Looks Like
Security leadership at most SaaS companies follows a predictable pattern. The CTO handles it. Not because they volunteered, but because nobody else...
CPCSC Compliance Consulting for Defence Contractors
CPCSC Level 1 attestation becomes a procurement requirement for Department of National Defence contracts in April 2026. Companies that can't attest...
What Does a SOC 2 Readiness Assessment Actually Include?
A SOC 2 readiness assessment is not the audit. It is the diagnostic step that tells a company exactly where it stands before committing budget and...
ISO 27001 Consultant in Canada: When It Makes Sense and What It Actually Takes
ISO 27001 certification gives you a one-to-two-page certificate. SOC 2 gives you a 40-to-50-page report describing every control, how it was tested,...
SOC 2 Implementation Cost and Timeline: What to Actually Budget
SOC 2 has four cost components. Most companies only budget for two of them, then get surprised by the rest halfway through the engagement.
Here is...
How to Choose a SOC 2 Consultant: A Checklist for SaaS Companies
The Two Types of SOC 2 Consultants
Platform-first firms compress the engagement into days or a few weeks. They take a policy template library, swap...
What Project Glasswing Actually Means for Your Security Program
I have been thinking about what Anthropic's Project Glasswing announcement actually means for the clients we advise. The honest answer is that it...
Risk Assessment and Security Planning for ITSP.10.171
The majority of ITSP.10.171 control families deal with operational security: how you configure systems, manage access, protect data. The Risk...
SOC 2 to CPCSC: Extending Your Security Program
The question comes up consistently when companies with established security programs look at entering the Canadian defence supply chain: Do we need...
Physical Security and Personnel Controls Under CPCSC
Every other control family in ITSP.10.171 has a reasonable analogue in the commercial compliance world. Access control maps to SOC 2 CC6. Incident...
Protecting Controlled Information: Media and Communications Security (CPCSC)
In a compliance landscape that increasingly assumes cloud-first architecture, media protection controls tend to get deprioritized. The assumption is...
Incident Response and System Integrity Under CPCSC
An incident response plan that exists only in a shared drive is not evidence of preparedness. It is evidence of intent, and the Canadian Program for...
Security Awareness, Training, and Governance for CPCSC
The previous twelve posts in this series covered the technical and operational control families in ITSP.10.171: access control, incident response,...
Configuration Management and System Maintenance for Defence Contractors Under CPCSC
There is a specific phrase that comes up in nearly every environment that has never been through a formal configuration review: We know our systems....
Audit Logging, Monitoring, and Accountability for CPCSC
Most organizations produce logs. Application servers generate them, firewalls record them, identity providers track them. The volume is rarely the...
Supply Chain Risk Management Under CPCSC
For most of the history of Canadian defence procurement, cybersecurity obligations ended at the prime contractor's perimeter. A prime could hold a...
Access Control and Identity Management Under ITSP.10.171
Every security program has access controls of some kind. Password policies exist, MFA is probably enabled somewhere, and someone has a spreadsheet...