Guides
Security paperwork, explained.
Plain-language guides to vendor security questionnaires, first security policies, and the SOC 2 criteria, for small teams that need them done.
Start hereSOC 2 criteriaSOC 2 Trust Services Criteria: an unofficial plain-English guideAn unofficial plain-English guide to the SOC 2 Trust Services Criteria: the five categories, what the CC and P numbers mean, and where a small team starts.Includes a free study tool.
Vendor questionnairesHiring help with a security questionnaire: what to checkShould you hire help with a security questionnaire? What to hand a contractor, what to check in the answers, the NDA question, and when to do it yourself.
Vendor questionnairesHECVAT Lite for edtech startups: what HECVAT 4 asksHECVAT 4 folded the Lite into one file. What it asks an edtech startup selling to universities, how schools score it, and how long it takes.
Security overviewWhat goes in a security overview document for customersA security overview (or security whitepaper, or trust page) answers a buyer’s first questions: what goes in, what stays private, and how to keep it true.
Security policiesAccess control policy for small SaaS: what to write and skipAn access control policy example for a small business or SaaS startup: eight sections to write, what to skip, and NIST's current password rules.
Vendor questionnairesYour first security questionnaire: a five-day planYour small company just got its first security questionnaire. How to answer it in five working days: scope it, gather the facts, draft, handle the gaps, send.
SOC 2 readinessDo you need SOC 2 yet? What to send before you have a reportAn enterprise customer asked for your SOC 2 report and you don’t have one. What the report is, whether you need it yet, and what to send in the meantime.
Incident responseAn incident response plan a five-person team will followAn incident response plan template for a small business or startup: who leads, how to rank severity, who to tell, and a 30-minute test. It fits on one page.
Security policiesThe first five security policies a startup needs before SOC 2Why policies come before controls and evidence, the five core policies to write first, what tailored means versus a template, and how the SOC 2 criteria fit in.
Vendor questionnairesSIG Lite and CAIQ-Lite: what they ask and how long they takeWhat the SIG Lite and CAIQ-Lite vendor security questionnaires are, who publishes them, how many questions they run, and the red flags reviewers spot.
Vendor questionnairesAnswering a security questionnaire when you don't have the controlWhy guessing on a vendor security questionnaire creates liability, how to describe a compensating control, how to phrase a roadmap item, and what reviewers tend to accept.
Rather have it written?
We write the policies and answer the questionnaire.
Tell us what the buyer or auditor is asking for, and we’ll send a flat-fee quote.