How-to
How to Get a Vendor's SOC 2 Report: AWS, Azure, NDA
A practical guide to getting a SOC 2 report: AWS Artifact, Azure's Service Trust Portal, and the NDA-gated request most SaaS vendors still use.
Solomon Amos · 31 Oct 2026 · 9 min read
Blog
How-to
Step-by-step vendor review work using public evidence.
How-to
How to Get a Business Associate Agreement Signed With a Vendor
Where Microsoft, Google and other large vendors actually route a BAA request: self-serve admin console or sales-gated contract exhibit.
Solomon Amos · 30 Oct 2026 · 9 min read
How-to
How to Perform a Vendor Risk Assessment Using Public Evidence
A step-by-step method for vendor risk assessment that starts with registries, trust centres and subprocessor lists before any questionnaire goes out.
Solomon Amos · 27 Oct 2026 · 9 min read
How-to
How to Get GovRAMP Certified: Tiers, Core and Authorization
A walk-through of GovRAMP's Core, Ready and Authorized tiers, and what a vendor's public GovRAMP framework entry actually discloses at each stage.
Solomon Amos · 19 Oct 2026 · 9 min read
How-to
How to Check an ISO 9001 Certificate Is Real
A step-by-step way to verify an ISO 9001 certificate against a certification body's public register, and why it is not a security framework.
Solomon Amos · 14 Oct 2026 · 9 min read
How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Map SIG Lite and CAIQ questionnaire domains to dated public evidence, so you know which rows are already answered and which still need a live reply.
Solomon Amos · 26 Sep 2026 · 8 min read
How-to
How to Check a Vendor's Subprocessor List
What a subprocessor list must include under the SCCs and most DPAs, how notice periods work, and how to compare lists across a shortlist.
Solomon Amos · 23 Sep 2026 · 8 min read
How-to
How to Verify a FedRAMP Marketplace Listing
A field by field guide to the FedRAMP Marketplace: certification class, agency, assessor, package status, and what the 2026 Consolidated Rules changed.
Solomon Amos · 19 Sep 2026 · 10 min read
How-to
How to read a SOC 2 report in 20 minutes
A section-by-section reading order for buyers: the opinion, Type and period, criteria in scope, carve-outs, exceptions and the controls you must run yourself.
Solomon Amos · 11 Sep 2026 · 11 min read
How-to
How to read a trust centre in ten minutes
Vanta, Drata and SafeBase trust centres all look alike. What each section actually proves, which badges are claims, what freshness signals matter, and how to get the facts out without requesting access.
Solomon Amos · 10 Sep 2026 · 10 min read
How-to
The BAA checklist: what to check before sending PHI to a vendor
HIPAA has no certification. The business associate agreement is the artefact. The ten clauses 45 CFR 164.504(e) requires, where vendors narrow them, and what to verify first.
Solomon Amos · 9 Sep 2026 · 11 min read
How-to
The Data Privacy Framework survived the General Court. What buyers should do while the appeal runs
The General Court dismissed the challenge to the EU-US DPF in September 2025 and an appeal (C-703/25 P) is pending. Practical steps for vendor reviews that rely on DPF listings, with the timeline.
Solomon Amos · 8 Sep 2026 · 9 min read
How-to
A 30-minute vendor security review using public evidence
The questions to answer before you email sales, in the order that saves the most time: registries first, vendor statements second, questionnaires last. With the numbers on why.
Solomon Amos · 30 Aug 2026 · 11 min read