SOC 2
SOC 2 bridge letters: what they cover and when customers accept them
A bridge letter covers the gap between the end of your last SOC 2 period and your next report. Customers usually accept one for a few months, not longer.
QULDEX Blog
Page 2 of 2
AI governance
ISO 42001: first steps for an AI management system
ISO/IEC 42001 applies management-system discipline to AI. If you already run an ISO 27001 ISMS, most of the scaffolding exists.
Evidence management
An audit evidence naming convention that survives three audits
Evidence that cannot be found, dated or traced to a control gets requested again. A five-part file name fixes most of that before any tool is involved.
SOC 2
How long should your first SOC 2 Type 2 observation window be?
Three, six or twelve months: the right first observation window depends on how long your controls have run, what your buyers will accept and when you need the report.
ISO 27001
ISO 27001:2022 transition: what changed and what auditors now check
The 2022 revision regrouped Annex A into four themes and added 11 controls. Here is what that means for your Statement of Applicability and your next surveillance audit.
EU regulation
DORA register of information: what financial entities must keep
DORA requires financial entities to maintain a register of all contractual arrangements with ICT third-party service providers, in a standard format supervisors can collect.