Safeguard on social

Is Safeguard SOC 2 compliant, are you FedRAMP authorized, and do you need an SBOM for SOC 2? Mira asks the compliance questions security and procurement teams ask in a vendor review, and Cal answers from Safeguard's published pages and docs: Safeguard is SOC 2 Type I and Type II audited, with reports available on request, the architecture is designed for FedRAMP High, what a readiness score is and is not, how to automate SOC 2 evidence without the screenshot sprint, and what to ask any security vendor for. For compliance leads, CISOs, security engineers and procurement reviewers working through SOC 2, FedRAMP, SBOM and vendor risk questions. Topics: SOC 2, SOC 2 Type I, SOC 2 Type II, FedRAMP High, SBOM, compliance automation, evidence collection, readiness score, vendor risk, Trust Center, CMMC, software supply chain security, security podcast, cybersecurity podcast, AppSec podcast, DevSecOps podcast. Chapters: 00:00 Cold open 00:24 Intro 00:43 Question 1: Is Safeguard itself SOC 2 compliant? 01:31 Question 2: Are you FedRAMP authorized? 02:15 Question 3: Do I need an SBOM for SOC 2? 03:17 Question 4: How do I automate SOC 2 evidence? 04:18 Question 5: Can I show a readiness score to an examiner? 05:09 Question 6: Does the security vendor I buy need its own SOC 2 report? 05:54 Recap and call to action 06:13 Outro Links: Safeguard: https://safeguard.sh/?utm_source=podcast&utm_medium=video&utm_campaign=ask-safeguard&utm_content=ep04 More episodes: https://safeguard.sh/podcast?utm_source=podcast&utm_medium=video&utm_campaign=ask-safeguard&utm_content=ep04 Listen on Spotify: https://open.spotify.com/show/03400iIvo19RZbfRDfPECc?utm_source=podcast&utm_medium=video&utm_campaign=ask-safeguard&utm_content=ep04

Before you add a dependency, look it up. Gold Open Source (https://na2.hubs.ly/H08CDG70) is free and needs no login: a package page shows the version Gold indexed, the known vulnerability count, a verification panel and an OpenSSF Scorecard grade. Then check the version against your pull request, read the license and look at the install scripts yourself. Full routine: https://na2.hubs.ly/H08CDH10 Stock footage: Mixkit (Mixkit Stock Video Free License). Page recordings: https://na2.hubs.ly/H08CDG70, public pages. #OpenSource #AppSec #Shorts

Your coding agents already emit telemetry. OpenAI Codex and Claude Code export OpenTelemetry, and Safeguard receives it: sessions, tool decisions and results, model calls, tokens and cost, with AI detections in Detection & Response that your SOC can act on. The ingest token is send-only, prompt content is off by default and credentials are redacted on arrival. OTLP setup guide: https://na2.hubs.ly/H08FpBx0 OpenAI API connector (new API keys, Owner grants, new service accounts, usage well above baseline and failed sign-in bursts become detections): https://na2.hubs.ly/H08Fpz-0 #AISecurity #OpenTelemetry #Shorts

Atlassian's October security bulletin lists 75 unique CVEs, all in bundled third-party libraries such as Tomcat, Netty and Bouncy Castle. When you buy a product you inherit its dependencies and its patch calendar. Know what is inside each vendor product and which version you run. Walkthrough: https://na2.hubs.ly/H08JhP10 #AppSec #SupplyChainSecurity #Shorts

ASUS fixed three High rated router flaws on 23 October: CVE-2026-93489 (authentication bypass) and CVE-2026-75775 and CVE-2026-75779 (root command injection). The CVE records list a firmware series and no fixed version. How many routers do you own, and do you know their firmware? Walkthrough: https://na2.hubs.ly/H08JhWD0 #NetworkSecurity #CVE #Shorts

A message lands on a Monday: a flaw in something you run has just been added to the known exploited list. You used to have three weeks. Now you may have three days. Mira and Cal explain how CISA's BOD 26-04, issued in June 2026, replaced one patch deadline with four facts: is the asset exposed to the internet, is the flaw on the KEV catalog, can an attacker automate the exploit, and does it give partial or total control. They cover what forensic triage means, the permission to wait at the bottom of the table, and how a private team can borrow the idea for vulnerability prioritisation: a fast lane for exploited flaws on exposed assets, a CI gate on known exploited CVEs, and honest risk acceptance. It is a practical episode on vulnerability management and patch management for AppSec and DevSecOps teams: how CVSS, EPSS and KEV fit together, why reachability and a software inventory (an SBOM) decide how fast you can do remediation, and what to say to a federal customer who asks about your patch SLA. In the news, in October: two exploited flaws added to the KEV catalog on 27 October, PolyShell in Adobe Commerce and Magento and a Brotli decoder flaw bundled in Node.js, and why their federal due date was fourteen days when two PHP flaws added the day before got three days plus a compromise check. Theo explains why to keep your old deadlines as a baseline, and the episode ends with six things to do this week. Topics: BOD 26-04, CISA KEV, forensic triage, CVSS, EPSS, CVE, exploit, Node.js, Brotli, Adobe Commerce, Magento, PolyShell, PHP, vulnerability prioritisation, CI gate, software supply chain security, open source security Chapters • 00:00 Cold open • 00:36 Intro • 01:00 News: two exploited flaws, two due dates • 03:41 What changed: the day the 21 day clock went away • 06:03 Deep dive: four facts, a fast lane and a floor • 09:32 Practitioner corner (Theo) • 10:23 Fix it this week • 11:35 Outro Links • Safeguard (https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep05) • BOD 26-04: the deadlines and forensic triage, explained (https://safeguard.sh/resources/blog/cisa-bod-26-04-kev-remediation-timelines-forensic-triage?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep05) • Should a CI gate block on known exploited vulnerabilities? (https://safeguard.sh/resources/blog/should-a-ci-gate-block-on-known-exploited-vulnerabilities?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep05) • Can you accept risk on a known exploited vulnerability? (https://safeguard.sh/resources/blog/can-you-accept-risk-on-a-known-exploited-vulnerability?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep05) • Free scan (Gold Open Source, no login) (https://gold.safeguard.sh/scan?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep05) Full dated source list: see the show notes.

A message lands on a Monday: a flaw in something you run has just been added to the known exploited list. You used to have three weeks. Now you may have three days. Mira and Cal explain how CISA's BOD 26-04, issued in June 2026, replaced one patch deadline with four facts: is the asset exposed to the internet, is the flaw on the KEV catalog, can an attacker automate the exploit, and does it give partial or total control. They cover what forensic triage means, the permission to wait at the bottom of the table, and how a private team can borrow the idea for vulnerability prioritisation: a fast lane for exploited flaws on exposed assets, a CI gate on known exploited CVEs, and honest risk acceptance. It is a practical episode on vulnerability management and patch management for AppSec and DevSecOps teams: how CVSS, EPSS and KEV fit together, why reachability and a software inventory (an SBOM) decide how fast you can do remediation, and what to say to a federal customer who asks about your patch SLA. In the news, in October: two exploited flaws added to the KEV catalog on 27 October, PolyShell in Adobe Commerce and Magento and a Brotli decoder flaw bundled in Node.js, and why their federal due date was fourteen days when two PHP flaws added the day before got three days plus a compromise check. Theo explains why to keep your old deadlines as a baseline, and the episode ends with six things to do this week. Topics: BOD 26-04, CISA KEV, forensic triage, CVSS, EPSS, CVE, exploit, Node.js, Brotli, Adobe Commerce, Magento, PolyShell, PHP, vulnerability prioritisation, CI gate, software supply chain security, open source security Chapters: 00:00 Cold open 00:36 Intro 01:00 News: two exploited flaws, two due dates 03:41 What changed: the day the 21 day clock went away 06:03 Deep dive: four facts, a fast lane and a floor 09:32 Practitioner corner (Theo) 10:23 Fix it this week 11:35 Outro Links: Safeguard: https://safeguard.sh/?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05 BOD 26-04: the deadlines and forensic triage, explained: https://safeguard.sh/resources/blog/cisa-bod-26-04-kev-remediation-timelines-forensic-triage?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05 Should a CI gate block on known exploited vulnerabilities?: https://safeguard.sh/resources/blog/should-a-ci-gate-block-on-known-exploited-vulnerabilities?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05 Can you accept risk on a known exploited vulnerability?: https://safeguard.sh/resources/blog/can-you-accept-risk-on-a-known-exploited-vulnerability?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05 Free scan (Gold Open Source, no login): https://gold.safeguard.sh/scan?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05 More episodes: https://safeguard.sh/podcast?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05 Listen on Spotify: https://open.spotify.com/show/03400iIvo19RZbfRDfPECc?utm_source=podcast&utm_medium=video&utm_campaign=the-fix-window&utm_content=ep05

Safeguard's Package Firewall is an install-time proxy for npm and pip. It sits between developers, CI and the public registries and blocks malicious, typosquatted and dependency confusion packages at install time. In the video: the real Safeguard CLI answer for a misspelled "requests". Walkthrough and CLI commands: https://na2.hubs.ly/H08Cv4p0 #SupplyChainSecurity #AppSec #Shorts

Your model, your call (1/3). Whether your team standardised on Anthropic's Claude or OpenAI's ChatGPT, the risk is depending on any single provider. In Safeguard you pick the model per task through one OpenAI-compatible endpoint with provider/model ids, so you change the id, not the integration. There are provider routes for Anthropic, OpenAI, Google, xAI, Mistral, Cohere and open-weight hosts. Compare candidates on your own prompts in the Workbench, bring your own model for Safeguard's AI features such as search and chat, or run Zero AI with no LLM anywhere. Footage: Mixkit stock (free license), read-only recordings of Safeguard docs and https://na2.hubs.ly/H08Fyr40, a terminal demo with a placeholder key. Compare models: https://na2.hubs.ly/H08Fyr50 Claude is a product of Anthropic. ChatGPT is a product of OpenAI. #AppSec #AISecurity #Shorts

OpenSSL 3.4 lost upstream support on 22 October 2026. 3.6 follows on 1 November. Upstream will then maintain 3.5 LTS (to April 2030), 4.0 (to May 2027) and 4.1 (to November 2027). Distribution packages follow the distribution's support. The risk is OpenSSL you build, bundle or install yourself, and base images nobody rebuilt. List every copy and its version, then move to a supported line. Guide and checker script: https://na2.hubs.ly/H08Cy6_0 #OpenSSL #AppSec #Shorts

NEC said a company it outsources work to was attacked in late September and valid accounts were misused against its customers. Osaka Metropolitan University and Osaka University each published notices. Can you name every company that touches your systems or your data? Timeline and vendor questions: https://na2.hubs.ly/H08C1b00 #ThirdPartyRisk #SupplyChainSecurity #Shorts

CISA put an Adobe Commerce and Magento flaw on its Known Exploited Vulnerabilities (KEV) list on 27 October 2026, and researchers say attackers have been using it since March. This first full Patch Monday briefing covers four stories from 21 to 27 October, each with what happened, who is stuck with it right now, and one thing to do on Monday morning. A CVE and vulnerability management story: CVE-2026-48356 in Adobe Commerce and Magento Open Source, how to patch it and how to check a store for web shells left behind. A cloud platform breach and secrets story: Railway's disclosure and preliminary report on an unauthorized party that may have accessed encrypted environment variables, and how to rotate API keys and credentials in the right order. A compliance story: the paused CMMC program, NIST SP 800-171 and what a defense supplier can do while the Pentagon decides, as reported by Federal News Network. And an AI coding agent security story: a malicious AGENTS.md file in a Downloads folder, Codex and Claude Code, and the malicious npm package an agent tried to install.

When a dependency has a known vulnerability and the maintainer has not shipped a fix, you can fork it and patch it yourself. This shows the fork-and-patch route in Safeguard and how the patched build stays tracked. Try Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=fix-stories&utm_content=fork-and-patch Full guide: https://safeguard.sh/resources/blog/fork-and-patch-vulnerable-packages Topics: fix vulnerable dependency, fork and patch, patch without upstream, open source remediation, software supply chain security.

Scan a container image in your CI pipeline before it is pushed or deployed, so a vulnerable base layer never reaches a registry. This shows where the scan sits in the pipeline and what a failed gate looks like. Try Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=safeguard-in-action&utm_content=container-scan-ci Full guide: https://safeguard.sh/resources/blog/scan-container-images-in-ci-with-safeguard-before-push-and-deploy Topics: container image scanning, scan Docker images in CI, container vulnerability scanning, DevSecOps pipeline.

PostgreSQL 14 is reaching end of life in November 2026. After that date it stops getting security fixes. This video shows how to find every place version 14 still runs and plan the upgrade before support ends. Try Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=fix-stories&utm_content=postgresql-14-eol Upgrade guide: https://safeguard.sh/resources/blog/postgresql-14-end-of-life-november-2026-upgrade-guide Topics: PostgreSQL 14 end of life, PostgreSQL upgrade, end of life software, software inventory, SBOM.

Stolen GitHub tokens are being used to push one workflow file that prints repository secrets into the Actions log. What to check in your org today: ci-sync-* branches, who can change workflows, token scope and lifetime, and required reviewers on production secrets. Sources: research published 25 Oct 2026; GitHub changelog, 28 Jul 2026. Full write-up: https://na2.hubs.ly/H08CbQt0 #GitHubActions #DevSecOps #Shorts

A real terminal session with the Safeguard CLI: install with one command, check the version, open the interactive terminal, ask for a change in plain words, approve each step, and scan a folder. Recorded live; this cut is captioned with a light music bed. For developers who want AppSec in the terminal and AI coding agent workflows with approvals. Try the interactive demo yourself: https://safeguard.sh/demos/safeguard-cli-in-action?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: Safeguard CLI, AI coding agent, command line security scanner, DevSecOps, AppSec, developer security, supply chain security, vulnerability scanning. Chapters 0:00 The Safeguard CLI, recorded live 0:06 Install with one command 0:20 Check the version 0:33 Open the interactive terminal 0:46 Ask in plain words 1:00 It reads first, then asks 1:13 Approve the install 1:27 Approve the tests 1:40 Done, with a summary 1:53 Choose how much it asks 2:06 Pick the model 2:20 Scan the folder 2:33 Install the CLI 2:39 Try it yourself

See how to set guardrails for AI agents and MCP tool access in Safeguard: choose the tools an agent may call, hide what it should not see, set request caps, and give each agent its own identity. A short product demo on AI agent security, Model Context Protocol (MCP) security, least privilege and AI guardrails. Try the interactive demo yourself: https://safeguard.sh/demos/mcp-guardrail?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: AI agent security, MCP security, Model Context Protocol, AI guardrails, least privilege, AI coding agents, agent permissions, AI governance. Chapters 0:00 Guardrails for AI agents 0:15 Guardrails 0:21 Choose the type 0:28 Pick the tools 0:36 Hide what it should not see 0:42 Set request caps 0:50 Saved 0:55 Agents have identities 1:03 Agents with limits 1:11 Try it yourself

Watch how to request a fixed, Gold version of a vulnerable open source package from your inventory in Safeguard Open Source Manager. Each request becomes a task assigned to Safeguard, for one package or every vulnerable package at once. A short product demo on vulnerability management, open source security and remediation when upstream has no fix. Try the interactive demo yourself: https://safeguard.sh/demos/fix-my-package?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: vulnerability management, remediation, open source security, software supply chain security, SBOM, dependency vulnerabilities, fork and patch, patch management. Chapters 0:00 Ask Safeguard for a fixed package 0:16 Your open source inventory 0:25 A package with no fix 0:36 Request sent 0:43 Source Gold for the inventory 0:51 The risks it covers 0:58 Tasks created 1:04 Fixed packages, on request 1:10 Try it yourself

Walk through getting ready for a SOC 2 Type 1 audit in Safeguard: turn on the framework, read your readiness score, see what the score rests on, open the controls, see why a control fails, turn gaps into tasks and plan the audit with your auditor. A short product demo on SOC 2 compliance automation, audit evidence and readiness gaps. Try the interactive demo yourself: https://safeguard.sh/demos/soc2-type1-in-a-day?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: SOC 2, SOC 2 Type 1, compliance automation, audit evidence, readiness assessment, controls, GRC, auditor, continuous compliance. Chapters 0:00 Get ready for a SOC2 Type 1 audit 0:16 Turn on SOC2 Type 1 0:25 Your readiness score 0:36 What the score rests on 0:47 Open the controls 0:56 See why a control fails 1:06 Gaps become tasks 1:15 Plan the audit 1:26 Ready to work with your auditor 1:34 Try it yourself

See continuous control monitoring in Safeguard: run every test, find the one that fails, see exactly what failed and who owns it, fix it, run it again, and watch the task close itself. A short product demo on continuous compliance, SOC 2 control testing and audit evidence that stays current. Try the interactive demo yourself: https://safeguard.sh/demos/continuous-monitoring?utm_source=youtube&utm_medium=video&utm_campaign=product-demos Safeguard: https://safeguard.sh/?utm_source=youtube&utm_medium=video&utm_campaign=product-demos The demo uses a sample workspace with test data only. Topics: continuous monitoring, continuous compliance, control testing, SOC 2, compliance automation, audit evidence, GRC, drift detection. Chapters 0:00 From a failing test to a fixed control 0:14 Run every test now 0:18 One test fails 0:24 Exactly what failed 0:30 Who owns it 0:35 Fix it, then run it again 0:40 Passing again 0:45 The task closed itself 0:50 Monitored every day 0:55 Try it yourself

In the news, in October: two sets of flaws that CISA added to its Known Exploited Vulnerabilities catalog. Two PHP flaws nicknamed php2shell that allow unauthenticated remote code execution, and flaws in Collabora Online and Arista's VeloCloud Orchestrator. Mira and Cal cover what the public sources say, what is not known, and how to find every place PHP hides, patch the internet-facing systems first and check Nextcloud for web shells. Then a vendor story. In October a large IT services company said a subcontractor it uses for development and maintenance had been attacked, and that the subcontractor's legitimate accounts were then used against its customers. Two universities came forward with two very different failures: ransomware on a core platform, reached through a maintenance account, and a leak of personal data affecting about 78,000 people from a vendor's cloud storage that held files from finished work, shared with a partner the university had never been told about. Then the deep dive. A large AI lab filed its S-1 in late October, and its risk factors are more candid than any trust portal. Cal shows how to read a filing for security-relevant facts, how to separate boilerplate from things that already happened, and how to turn dated disclosures into vendor questions on data retention, agents, SBOMs, model withdrawal and incident notice. Theo answers what to ask an AI vendor before approving a tool, and the episode ends with five things to add to your vendor intake. If you run vendor risk management or third-party risk, this episode covers how to read an AI vendor's filing for your risk review, what to ask for in a security questionnaire, how to request and validate an SBOM, how to keep an AI-BOM, and how to handle vulnerability management and patch management when CISA adds exploited flaws to its KEV catalog. It also covers software supply chain security, subcontractor risk and prompt injection in AI agents. 00:00 Cold open, 00:32 Intro, 00:40 In the news, 03:32 The incident, 07:35 Deep dive, 15:25 Practitioner corner, 16:38 Fix it this week, 18:23 Outro. Sources S-1 guide (https://safeguard.sh/resources/blog/anthropic-s-1-ai-vendor-risk-security-teams?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep03) Incident (https://safeguard.sh/resources/blog/nec-subcontractor-breach-osaka-metropolitan-university-ransomware-osaka-university-77851?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep03) CISA PHP alert (https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) CISA KEV (https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) News (https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html) Topics: vendor risk management, third-party risk, TPRM, SBOM, AI-BOM, security questionnaire, CISA KEV, CVE-2026-109618, CVE-2026-109619, CVE-2026-110447, CVE-2026-114625, PHP, Nextcloud, patch management, software supply chain security, prompt injection, S-1 filing.

A hospital group says yes to your demo, then sends a contract with three letters in the title. B A A. There is no HIPAA certificate you can hold up, so what will they ask you to show? Mira and Cal sit in the reviewer's chair for a small software vendor's first request list from a hospital's privacy lead: a dated risk analysis, the sub-processor agreements, log review proof, training records and a breach notification path. They explain who counts as a business associate, what the rule says a B A A must contain, what required and addressable really mean, why the risk analysis comes first, and where the proposed Security Rule rewrite stands (a proposal, with a federal target of July 2027). Before that, two late October stories about patient data in someone else's system: the Quest Diagnostics filing about unauthorized access to a system clinics use for lab orders, and a Denver Health Medical Plan vendor incident involving an access key on a public website. Theo asks where a patient's name ends up in your company that is not the database. The episode ends with a checklist for before your window opens. Topics: HIPAA, business associate agreement (BAA), Security Rule, risk analysis, required and addressable, breach notification, vendor risk, SaaS compliance, Quest Diagnostics, Denver Health Medical Plan. Chapters 00:00 Cold open 00:46 Intro 01:14 News: two late October stories on vendors and patient data 05:14 Audit story: a hospital's request list, from the reviewer's chair 08:19 Deep dive: business associates, the BAA and the Security Rule 14:30 Practitioner corner 15:41 Before your window opens 17:15 Outro Sources HIPAA: what it is and who has to comply: https://safeguard.sh/resources/blog/hipaa-what-it-is-and-who-needs-to-comply?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA audit findings: why risk analysis tops the list: https://safeguard.sh/resources/blog/hipaa-audit-findings-risk-analysis-first?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA compliance checklist for SaaS companies: https://safeguard.sh/resources/blog/hipaa-compliance-checklist-for-saas?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA glossary: the terms engineers and buyers mix up: https://safeguard.sh/resources/blog/hipaa-glossary-plain-language-terms?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 How do you answer HIPAA questions on a customer security que: https://safeguard.sh/resources/blog/answering-customer-security-questionnaires-hipaa-questions?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 What should a startup do in its first 90 days of HIPAA?: https://safeguard.sh/resources/blog/hipaa-first-90-days-for-a-startup?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA Security Rule: how to automate evidence collection: https://safeguard.sh/resources/blog/hipaa-security-rule-automating-evidence-collection?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 How do software supply chain controls map to HIPAA?: https://safeguard.sh/resources/blog/hipaa-software-supply-chain-controls-mapped?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02 HIPAA Security Rule in Safeguard: risk analysis, safeguards : https://safeguard.sh/resources/blog/hipaa-security-rule-in-safeguard-risk-analysis-technical-safeguards-and-evidence?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02

A buyer asks for an ISO 27001 certificate when you already hold a SOC 2 report. How much of the work do you get to keep? Mira and Cal sit in the auditor's chair for a first ISO audit, from stage 1 documentation review to stage 2 testing and the surveillance visits that follow. They explain what the Statement of Applicability is, how Annex A (2022) is organised into 93 controls in four themes, why the management system around the controls is the part a SOC 2 never asks you to build, and which evidence (change and vulnerability management, access reviews, scan results) carries over. Before that, two October stories on paper trails: the DHS order on DeepSeek products in the Federal Register and the EDPB's anonymisation consultation. Theo takes a question to settle before you write a word of the ISMS: is your ISO scope the same as your SOC 2 system boundary? The episode ends with a checklist for before your window opens. Topics: ISO 27001, SOC 2, Statement of Applicability, Annex A (2022), management system, stage 1 and stage 2 audit, surveillance audit, scope, DHS Order #2026-01, EDPB anonymisation. Chapters 00:00 Cold open 00:34 Intro 00:54 News: the DHS supplier order and the EDPB anonymisation consultation 03:23 Audit story: a first ISO 27001 audit, stage 1 to stage 2 05:52 Deep dive: the Statement of Applicability, Annex A and what carries over from SOC 2 09:43 Practitioner corner 10:39 Before your window opens 11:40 Outro Sources What is ISO 27001?: https://safeguard.sh/resources/blog/what-is-iso-27001?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001:2022 Annex A controls guide: https://safeguard.sh/resources/blog/iso-27001-annex-a-controls-guide?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 certification: complete guide and requirements: https://safeguard.sh/resources/blog/iso-27001-certification-complete-guide-and-requirements?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 compliance for software development teams: https://safeguard.sh/resources/blog/iso-27001-compliance-for-software-development-teams?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 risk assessment: how to conduct one: https://safeguard.sh/resources/blog/iso-27001-risk-assessment-how-to-conduct-one?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 monitoring between surveillance audits: https://safeguard.sh/resources/blog/iso-27001-monitoring-between-surveillance-audits?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 ISO 27001 vs SOC 2: which framework is right for you: https://safeguard.sh/resources/blog/iso-27001-vs-soc-2-which-framework-is-right-for-you?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 Your first SOC 2 audit should not require your first complia: https://safeguard.sh/resources/blog/scale-up-soc2-iso-compliance-without-a-team?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 SOC 2 Type II vs ISO 27001: what each certification actually: https://safeguard.sh/resources/blog/soc-2-type-ii-vs-iso-27001-what-each-certification-actually-covers?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01 DHS Exclusion and Removal Order #2026-01, Federal Register n: https://www.federalregister.gov/d/2026-21447?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01