Blog
The frameworks, registries and artefacts in buyer terms.
SOC 2 is an attestation report with an opinion, a period and an auditor. Nobody issues a certificate. What the phrase hides, why it spreads, and the four facts to ask for instead.
Solomon Amos · 15 Sep 2026 · 9 min read
Type I says controls were designed properly on one date. Type II says they operated over a period with sampled evidence and listed exceptions. Which to accept, when, and what to ask.
Solomon Amos · 14 Sep 2026 · 10 min read
A bridge letter covers the gap between a SOC report period end and the next report. It is a management statement, not an audit. What it must contain, the 90-day norm, and where it stops.
Solomon Amos · 12 Sep 2026 · 9 min read
What a DPF listing proves, the usage end date, the UK and Swiss extensions, the pending Court of Justice appeal, and how to read a DPF row before you sign a DPA.
Solomon Amos · 7 Sep 2026 · 10 min read
How to read the FedRAMP Marketplace after the Consolidated Rules for 2026: the new Certified label, certification classes, what happened to Ready and In Process, and what 20x changes.
CertReports Research · 5 Sep 2026 · 10 min read
There is no PCI SSC list of compliant companies. Public PCI DSS evidence lives on the Visa Global Registry and the Mastercard SDP list. How each works, the twelve-month clock, and what an AOC must say.
CertReports Research · 3 Sep 2026 · 10 min read
The IAF transition ended on 31 October 2025. What changed between the editions, why 2013 certificates are lapsed for accredited purposes, and how to read scope, sites and surveillance on a certificate.
Solomon Amos · 1 Sep 2026 · 10 min read
