Author
Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
TPRM explained through the evidence it actually runs on: SOC 2 reports, subprocessor lists and DPAs, and how much of that is already public.
Solomon Amos · 2 Nov 2026 · 10 min read
MTCS is Singapore's three-tier cloud security standard, SS 584. Here is how Level 1 to 3 certification maps to the ISO 27001 evidence in vendor trust centres.
Solomon Amos · 1 Nov 2026 · 9 min read
A practical guide to getting a SOC 2 report: AWS Artifact, Azure's Service Trust Portal, and the NDA-gated request most SaaS vendors still use.
Solomon Amos · 31 Oct 2026 · 9 min read
Where Microsoft, Google and other large vendors actually route a BAA request: self-serve admin console or sales-gated contract exhibit.
Solomon Amos · 30 Oct 2026 · 9 min read
A plain-English guide to data processing agreements: the Article 28 clauses GDPR requires, where vendors publish them, and when buyers must have one signed.
Solomon Amos · 29 Oct 2026 · 9 min read
A trust centre is a vendor's security evidence hub, not Microsoft Office's privacy settings menu. Here is how to tell marketing text from proof.
Solomon Amos · 28 Oct 2026 · 10 min read
A step-by-step method for vendor risk assessment that starts with registries, trust centres and subprocessor lists before any questionnaire goes out.
Solomon Amos · 27 Oct 2026 · 9 min read
IRAP endorses individual assessors, not vendors. Learn what an IRAP assessment report actually proves and what to ask for instead of a badge.
Solomon Amos · 26 Oct 2026 · 9 min read
HDS usually means France's health data hosting certification, not a medical term or a Philippines platform name. Here's the real scope.
Solomon Amos · 25 Oct 2026 · 9 min read
BSI C5 is Germany's cloud security criteria catalogue. Learn what it actually proves, which country it applies to, and how to spot a real Type 2 report.
Solomon Amos · 24 Oct 2026 · 9 min read
ISO 27001 Annex A lists 93 controls across four themes. Here is what a vendor's Statement of Applicability discloses, and what to request instead.
Solomon Amos · 23 Oct 2026 · 9 min read
The EU AI Act entered into force in 2024 but phases in through 2027. Here is the real timeline, and the ISO 42001 evidence vendors are publishing early.
Solomon Amos · 22 Oct 2026 · 10 min read
NIS2 explained: what its supply-chain clause asks of vendors, and which ISO 27001, SOC 2 and C5 evidence actually answers it.
Solomon Amos · 21 Oct 2026 · 9 min read
A plain explainer on ANSSI's SecNumCloud qualification, version 3.2, and why AWS, Microsoft and Google route around it through French subsidiaries instead.
Solomon Amos · 20 Oct 2026 · 9 min read
A walk-through of GovRAMP's Core, Ready and Authorized tiers, and what a vendor's public GovRAMP framework entry actually discloses at each stage.
Solomon Amos · 19 Oct 2026 · 9 min read
GovRAMP and FedRAMP are run by different bodies for different buyers. A listing in one has no public evidence in the other. Here is how to tell them apart.
Solomon Amos · 18 Oct 2026 · 9 min read
What separates the self-assessed Cyber Essentials questionnaire from the audited Plus test, and why the renewal date matters more than the badge.
Solomon Amos · 17 Oct 2026 · 9 min read
TISAX is not a public certificate. Here is what AL1, AL2 and AL3 mean, how ENX sharing works, and how to verify a vendor's claim.
Solomon Amos · 16 Oct 2026 · 9 min read
CCPA has no certificate or audit report attached to it. Here is the real evidence to check: privacy notices, opt-out links and data processing terms.
Solomon Amos · 15 Oct 2026 · 9 min read
A step-by-step way to verify an ISO 9001 certificate against a certification body's public register, and why it is not a security framework.
Solomon Amos · 14 Oct 2026 · 9 min read
ISO 22301 certifies business continuity, not information security. Here is how to check a vendor's BCMS claim against its own certificate evidence.
Solomon Amos · 13 Oct 2026 · 9 min read
ISO 27017 and 27018 are extensions of an ISO 27001 certificate, not standalone badges. Here is how to check a vendor's real scope statement.
Solomon Amos · 12 Oct 2026 · 9 min read
UK GDPR split from EU GDPR after Brexit and runs alongside the Data Protection Act 2018. Here is what changed, and what vendor evidence to check.
Solomon Amos · 11 Oct 2026 · 9 min read
SOC 3 is the public summary of a SOC 2 engagement with the control detail removed. Here is what that means and how often vendors publish one without the other.
Solomon Amos · 10 Oct 2026 · 9 min read
HITRUST issues three assessment levels, e1, i1 and r2, with very different scope and validity. Here is what each one actually certifies.
Solomon Amos · 10 Oct 2026 · 9 min read
ISO 27701 extends an ISO 27001 certificate to cover privacy management. It is not a GDPR seal. Here's what the index shows vendors actually hold.
Solomon Amos · 3 Oct 2026 · 9 min read
GDPR reaches US vendors that sell into the EU or track EU residents. Here is how to check DPF status and EU representative evidence, not assertions.
Solomon Amos · 2 Oct 2026 · 9 min read
GDPR has no certification scheme, so a vendor's GDPR compliant claim has no registry behind it. Here is what public evidence exists instead.
Solomon Amos · 1 Oct 2026 · 9 min read
Map SIG Lite and CAIQ questionnaire domains to dated public evidence, so you know which rows are already answered and which still need a live reply.
Solomon Amos · 26 Sep 2026 · 8 min read
Which vendors publish ISO/IEC 42001 evidence, what the AI management system certificate actually scopes, and what to ask before you rely on it.
Solomon Amos · 25 Sep 2026 · 9 min read
Cyber Essentials is a UK government-backed scheme with a 12-month certificate and an IASME-run register. Here is what basic versus Plus actually proves.
Solomon Amos · 24 Sep 2026 · 9 min read
What a subprocessor list must include under the SCCs and most DPAs, how notice periods work, and how to compare lists across a shortlist.
Solomon Amos · 23 Sep 2026 · 8 min read
CSA STAR ranges from a free self-assessment to an audited certification. Here is what a registry entry shows, and how it relates to ISO 27001 and SOC 2.
Solomon Amos · 22 Sep 2026 · 9 min read
HIPAA eligible is an infrastructure claim, not a certificate. Here is what the BAA obliges you to configure and how to read a covered services list.
Solomon Amos · 21 Sep 2026 · 10 min read
A field by field guide to the FedRAMP Marketplace: certification class, agency, assessor, package status, and what the 2026 Consolidated Rules changed.
Solomon Amos · 19 Sep 2026 · 10 min read
A report is not a certificate. Here is what SOC 2 and ISO 27001 actually prove, who issues each one, and which to require for which data.
Solomon Amos · 18 Sep 2026 · 9 min read
SOC 2 is an attestation report with an opinion, a period and an auditor. Nobody issues a certificate. What the phrase hides, why it spreads, and the four facts to ask for instead.
Solomon Amos · 15 Sep 2026 · 9 min read
Type I says controls were designed properly on one date. Type II says they operated over a period with sampled evidence and listed exceptions. Which to accept, when, and what to ask.
Solomon Amos · 14 Sep 2026 · 10 min read
A bridge letter covers the gap between a SOC report period end and the next report. It is a management statement, not an audit. What it must contain, the 90-day norm, and where it stops.
Solomon Amos · 12 Sep 2026 · 9 min read
A section-by-section reading order for buyers: the opinion, Type and period, criteria in scope, carve-outs, exceptions and the controls you must run yourself.
Solomon Amos · 11 Sep 2026 · 11 min read
Vanta, Drata and SafeBase trust centres all look alike. What each section actually proves, which badges are claims, what freshness signals matter, and how to get the facts out without requesting access.
Solomon Amos · 10 Sep 2026 · 10 min read
HIPAA has no certification. The business associate agreement is the artefact. The ten clauses 45 CFR 164.504(e) requires, where vendors narrow them, and what to verify first.
Solomon Amos · 9 Sep 2026 · 11 min read
The General Court dismissed the challenge to the EU-US DPF in September 2025 and an appeal (C-703/25 P) is pending. Practical steps for vendor reviews that rely on DPF listings, with the timeline.
Solomon Amos · 8 Sep 2026 · 9 min read
What a DPF listing proves, the usage end date, the UK and Swiss extensions, the pending Court of Justice appeal, and how to read a DPF row before you sign a DPA.
Solomon Amos · 7 Sep 2026 · 10 min read
The IAF transition ended on 31 October 2025. What changed between the editions, why 2013 certificates are lapsed for accredited purposes, and how to read scope, sites and surveillance on a certificate.
Solomon Amos · 1 Sep 2026 · 10 min read
The questions to answer before you email sales, in the order that saves the most time: registries first, vendor statements second, questionnaires last. With the numbers on why.
Solomon Amos · 30 Aug 2026 · 11 min read