Publications
Evidence and operations
Policies, evidence, exceptions, access reviews and the day to day work of staying audit ready.
Your policy says one thing. Your company does another.
Why security policies stop matching what your company does, how ISO 27001 and SOC 2 auditors catch it, and how to keep documents and reality aligned.
· 4 min readRead Evidence and operationsUser access reviews: how to run one that isn't rubber stamped
What ISO 27001 and SOC 2 expect from user access reviews, why most are rubber stamped, and a process with full lists, the right reviewers and dated evidence.
· 4 min readRead Evidence and operationsHow to build a risk register people actually use
Why ISO 27001 risk registers turn into ignored spreadsheets, what clauses 6.1.2 and 8.2 require, and how to build a short register linked to real controls.
· 4 min readRead Evidence and operationsAudit evidence collection: stop taking screenshots for your auditor
What auditors want from SOC 2 and ISO 27001 evidence, why screenshots are weak, how sampling works, and how to collect evidence as part of the work.
· 4 min readRead Evidence and operationsThe shadow register: the security exceptions every company has and nobody tracks
Why unrecorded security exceptions become permanent risks, what ISO 27001 and SOC 2 expect, and how to run an exception register with owners and expiry dates.
· 4 min readRead