What auditors accept as evidence, and how to collect it without a six-week scramble.
It is planned and the outline below is a first draft, so it may yet change. There is no enrolment and no date — when it is ready it will be on this page.
If you need this capability now rather than later, Compliance workspace is the service that covers it, or talk to us.
The person who has been handed a SOC 2 or ISO 27001 project alongside their existing job, which is the usual arrangement.
Practitioner. For people who administer these systems day to day.
No prerequisites. Nothing is assumed beyond using a computer at work.
3 modules, 9 lessons, 1 h 42 m of material. The times are the sum of the lessons rather than a round figure.
Not your security. Whether your controls do what you said they do, consistently.
Three different things, and the one auditors ask for.
Design against operation, and why the window shapes the whole project.
Systems, data and people in scope, and the cost of a boundary drawn too wide.
A screenshot with no date proves nothing, and that is the most common submission.
Completeness, population, dates, and the system of record.
Making evidence fall out of the work instead of being reconstructed.
A documented exception is a finding avoided.
They are the same ones. Closing them in advance is cheaper than explaining them.
The single most common finding, and the process that prevents it.
Evidence of review, for teams too small to separate duties fully.
The register, the reviews, and the subprocessors nobody listed.
Format. Written lessons with evidence templates. Delivery mechanism is not built yet.
The attacks that pass SPF, DKIM and DMARC, and the habits that catch them anyway.
Course outline ⟶Getting to an enforced policy without losing legitimate mail on the way.
Course outline ⟶Identity is the perimeter now. This is how to configure it without locking everyone out.
Course outline ⟶This course exists because the work behind it is work we do. If you need the result rather than the skill, compliance workspace is the service that covers it.