How-to
How to read a SOC 2 report in 20 minutes
A section-by-section reading order for buyers: the opinion, Type and period, criteria in scope, carve-outs, exceptions and the controls you must run yourself.
Solomon Amos · 11 Sep 2026 · 11 min read
Blog
How-to
Step-by-step vendor review work using public evidence.
How-to
How to read a trust centre in ten minutes
Vanta, Drata and SafeBase trust centres all look alike. What each section actually proves, which badges are claims, what freshness signals matter, and how to get the facts out without requesting access.
Solomon Amos · 10 Sep 2026 · 10 min read
How-to
The BAA checklist: what to check before sending PHI to a vendor
HIPAA has no certification. The business associate agreement is the artefact. The ten clauses 45 CFR 164.504(e) requires, where vendors narrow them, and what to verify first.
Solomon Amos · 9 Sep 2026 · 11 min read
How-to
The Data Privacy Framework survived the General Court. What buyers should do while the appeal runs
The General Court dismissed the challenge to the EU-US DPF in September 2025 and an appeal (C-703/25 P) is pending. Practical steps for vendor reviews that rely on DPF listings, with the timeline.
Solomon Amos · 8 Sep 2026 · 9 min read
How-to
A 30-minute vendor security review using public evidence
The questions to answer before you email sales, in the order that saves the most time: registries first, vendor statements second, questionnaires last. With the numbers on why.
Solomon Amos · 30 Aug 2026 · 11 min read