[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:soc2\u002Foverview":3},{"item":4,"lessons":15,"controls":66,"related":93},{"family":5,"item":6,"code":7,"title":7,"citations":8,"publisher":9,"summary_md":10,"official_text":11,"official_attribution":11,"official_url":12,"link_label":13,"note":11,"updated_at":14},"soc2","overview","SOC 2",15,"AICPA","**What it covers.** SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards on a service organisation's controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always included, while the others are optional. A Type 1 report assesses control design at a point in time, and a Type 2 report also tests operating effectiveness over a period.\n\n**In practice.** Service organisations define the system in scope, design controls to meet the selected criteria and gather evidence continuously for the audit period. Customers review the report, including the auditor's opinion, exceptions, scope, carved out subservice organisations and complementary user entity controls they are expected to operate themselves. Evidence includes policies, access reviews, change records, monitoring and incident records.\n\n**Common gaps.** Customers often read only the opinion and miss exceptions or scope limitations. Complementary user entity controls are frequently not implemented by the customer.",null,"https:\u002F\u002Fwww.aicpa-cima.com\u002Ftopic\u002Faudit-assurance\u002Faudit-and-assurance-greater-than-soc-2","Read about SOC 2","2026-10-18T15:18:43.663+00:00",{"total":16,"list":17},13,[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ransomware-negotiator-arrested-for-extortion-insider-threat-within-cybersecurity-industry","Ransomware Negotiator Arrested for Extortion: Insider Threat Within Cybersecurity Industry","2026-10-12T22:20:50.499+00:00",{"slug":23,"title":24,"published_at":25},"rmm-platforms-demand-rigorous-security-controls-due-to-privileged-access-risks","RMM Platforms Demand Rigorous Security Controls Due to Privileged Access Risks","2026-10-06T16:22:13.733+00:00",{"slug":27,"title":28,"published_at":29},"ai-agents-expose-critical-gaps-in-soc-2-compliance-framework","AI Agents Expose Critical Gaps in SOC 2 Compliance Framework","2026-09-25T20:21:39.812+00:00",{"slug":31,"title":32,"published_at":33},"ai-safety-concerns-prompt-researcher-resignation-at-anthropic","AI Safety Concerns Prompt Researcher Resignation at Anthropic","2026-09-10T16:21:49.445+00:00",{"slug":35,"title":36,"published_at":37},"critical-rce-in-n-central-rmm-patched-under-active-exploitation","Critical RCE in N-central RMM Patched Under Active Exploitation","2026-09-07T08:20:41.203+00:00",{"slug":39,"title":40,"published_at":41},"court-case-management-platform-breach-exposes-ssns-and-sealed-records-across-11-states","Court Case Management Platform Breach Exposes SSNs and Sealed Records Across 11 States","2026-09-03T18:21:19.007+00:00",{"slug":43,"title":44,"published_at":45},"soc-alert-fatigue-why-human-only-triage-is-failing-and-how-ai-can-help","SOC Alert Fatigue: Why Human-Only Triage is Failing and How AI Can Help","2026-08-26T12:20:24.312+00:00",{"slug":47,"title":48,"published_at":49},"n-able-passportal-flaw-exposes-password-vault-master-keys","N-able Passportal Flaw Exposes Password Vault Master Keys","2026-08-20T18:20:40.6+00:00",{"slug":51,"title":52,"published_at":53},"lastpass-customer-data-exposed-via-third-party-partner-breach","LastPass Customer Data Exposed via Third-Party Partner Breach","2026-06-27T12:20:21.432+00:00",{"slug":55,"title":56,"published_at":57},"ai-agent-identities-create-new-security-blind-spots-in-the-enterprise","AI Agent Identities Create New Security Blind Spots in the Enterprise","2026-06-16T17:20:22.059+00:00",{"slug":59,"title":60,"published_at":61},"ai-coding-tools-create-security-validation-gap-in-development-lifecycle","AI coding tools create security validation gap in development lifecycle","2026-05-27T16:20:27.825+00:00",{"slug":63,"title":64,"published_at":65},"vercel-breach-highlights-cloud-platform-security-risks","Vercel Breach Highlights Cloud Platform Security Risks","2026-04-19T19:08:10.611+00:00",[67,72,76,80,85,89],{"slug":68,"name":69,"problem":70,"stories":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",3,{"slug":73,"name":74,"problem":75,"stories":71},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":77,"name":78,"problem":79,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":81,"name":82,"problem":83,"stories":84},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",2,{"slug":86,"name":87,"problem":88,"stories":84},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":90,"name":91,"problem":92,"stories":84},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[94,98,104,110,115,119,123,127],{"family":95,"item":6,"code":96,"title":96,"together":97},"itil","ITIL",7,{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-800-53","ac-2","AC-2","Account Management",6,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","6","Control 6","Access Control Management",5,{"family":99,"item":111,"code":112,"title":113,"together":114},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",4,{"family":105,"item":116,"code":117,"title":118,"together":114},"15","Control 15","Service Provider Management",{"family":105,"item":120,"code":121,"title":122,"together":114},"8","Control 8","Audit Log Management",{"family":105,"item":124,"code":125,"title":126,"together":71},"7","Control 7","Continuous Vulnerability Management",{"family":128,"item":129,"code":130,"title":131,"together":71},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships"]