Blog
The frameworks, registries and artefacts in buyer terms.
TPRM explained through the evidence it actually runs on: SOC 2 reports, subprocessor lists and DPAs, and how much of that is already public.
Solomon Amos · 2 Nov 2026 · 10 min read
MTCS is Singapore's three-tier cloud security standard, SS 584. Here is how Level 1 to 3 certification maps to the ISO 27001 evidence in vendor trust centres.
Solomon Amos · 1 Nov 2026 · 9 min read
A plain-English guide to data processing agreements: the Article 28 clauses GDPR requires, where vendors publish them, and when buyers must have one signed.
Solomon Amos · 29 Oct 2026 · 9 min read
A trust centre is a vendor's security evidence hub, not Microsoft Office's privacy settings menu. Here is how to tell marketing text from proof.
Solomon Amos · 28 Oct 2026 · 10 min read
IRAP endorses individual assessors, not vendors. Learn what an IRAP assessment report actually proves and what to ask for instead of a badge.
Solomon Amos · 26 Oct 2026 · 9 min read
HDS usually means France's health data hosting certification, not a medical term or a Philippines platform name. Here's the real scope.
Solomon Amos · 25 Oct 2026 · 9 min read
BSI C5 is Germany's cloud security criteria catalogue. Learn what it actually proves, which country it applies to, and how to spot a real Type 2 report.
Solomon Amos · 24 Oct 2026 · 9 min read
ISO 27001 Annex A lists 93 controls across four themes. Here is what a vendor's Statement of Applicability discloses, and what to request instead.
Solomon Amos · 23 Oct 2026 · 9 min read
The EU AI Act entered into force in 2024 but phases in through 2027. Here is the real timeline, and the ISO 42001 evidence vendors are publishing early.
Solomon Amos · 22 Oct 2026 · 10 min read
NIS2 explained: what its supply-chain clause asks of vendors, and which ISO 27001, SOC 2 and C5 evidence actually answers it.
Solomon Amos · 21 Oct 2026 · 9 min read
A plain explainer on ANSSI's SecNumCloud qualification, version 3.2, and why AWS, Microsoft and Google route around it through French subsidiaries instead.
Solomon Amos · 20 Oct 2026 · 9 min read
What separates the self-assessed Cyber Essentials questionnaire from the audited Plus test, and why the renewal date matters more than the badge.
Solomon Amos · 17 Oct 2026 · 9 min read
TISAX is not a public certificate. Here is what AL1, AL2 and AL3 mean, how ENX sharing works, and how to verify a vendor's claim.
Solomon Amos · 16 Oct 2026 · 9 min read
CCPA has no certificate or audit report attached to it. Here is the real evidence to check: privacy notices, opt-out links and data processing terms.
Solomon Amos · 15 Oct 2026 · 9 min read
ISO 22301 certifies business continuity, not information security. Here is how to check a vendor's BCMS claim against its own certificate evidence.
Solomon Amos · 13 Oct 2026 · 9 min read
ISO 27017 and 27018 are extensions of an ISO 27001 certificate, not standalone badges. Here is how to check a vendor's real scope statement.
Solomon Amos · 12 Oct 2026 · 9 min read
UK GDPR split from EU GDPR after Brexit and runs alongside the Data Protection Act 2018. Here is what changed, and what vendor evidence to check.
Solomon Amos · 11 Oct 2026 · 9 min read
SOC 3 is the public summary of a SOC 2 engagement with the control detail removed. Here is what that means and how often vendors publish one without the other.
Solomon Amos · 10 Oct 2026 · 9 min read
HITRUST issues three assessment levels, e1, i1 and r2, with very different scope and validity. Here is what each one actually certifies.
Solomon Amos · 10 Oct 2026 · 9 min read
ISO 27701 extends an ISO 27001 certificate to cover privacy management. It is not a GDPR seal. Here's what the index shows vendors actually hold.
Solomon Amos · 3 Oct 2026 · 9 min read
GDPR has no certification scheme, so a vendor's GDPR compliant claim has no registry behind it. Here is what public evidence exists instead.
Solomon Amos · 1 Oct 2026 · 9 min read
Cyber Essentials is a UK government-backed scheme with a 12-month certificate and an IASME-run register. Here is what basic versus Plus actually proves.
Solomon Amos · 24 Sep 2026 · 9 min read
CSA STAR ranges from a free self-assessment to an audited certification. Here is what a registry entry shows, and how it relates to ISO 27001 and SOC 2.
Solomon Amos · 22 Sep 2026 · 9 min read
HIPAA eligible is an infrastructure claim, not a certificate. Here is what the BAA obliges you to configure and how to read a covered services list.
Solomon Amos · 21 Sep 2026 · 10 min read
A report is not a certificate. Here is what SOC 2 and ISO 27001 actually prove, who issues each one, and which to require for which data.
Solomon Amos · 18 Sep 2026 · 9 min read
SOC 2 is an attestation report with an opinion, a period and an auditor. Nobody issues a certificate. What the phrase hides, why it spreads, and the four facts to ask for instead.
Solomon Amos · 15 Sep 2026 · 9 min read
Type I says controls were designed properly on one date. Type II says they operated over a period with sampled evidence and listed exceptions. Which to accept, when, and what to ask.
Solomon Amos · 14 Sep 2026 · 10 min read
A bridge letter covers the gap between a SOC report period end and the next report. It is a management statement, not an audit. What it must contain, the 90-day norm, and where it stops.
Solomon Amos · 12 Sep 2026 · 9 min read
What a DPF listing proves, the usage end date, the UK and Swiss extensions, the pending Court of Justice appeal, and how to read a DPF row before you sign a DPA.
Solomon Amos · 7 Sep 2026 · 10 min read
How to read the FedRAMP Marketplace after the Consolidated Rules for 2026: the new Certified label, certification classes, what happened to Ready and In Process, and what 20x changes.
CertReports Research · 5 Sep 2026 · 10 min read
There is no PCI SSC list of compliant companies. Public PCI DSS evidence lives on the Visa Global Registry and the Mastercard SDP list. How each works, the twelve-month clock, and what an AOC must say.
CertReports Research · 3 Sep 2026 · 10 min read
The IAF transition ended on 31 October 2025. What changed between the editions, why 2013 certificates are lapsed for accredited purposes, and how to read scope, sites and surveillance on a certificate.
Solomon Amos · 1 Sep 2026 · 10 min read