Blog
Practical notes on SOC 2, ISO 27001, evidence, and the months between audits.
ISO 27001 A.8.1 User endpoint devices: What to Enforce on Which Devices, and How to Prove It
ISO 27001 A.8.1 User endpoint devices: decide which devices are in scope, what to enforce per tier and what evidence shows it works.
8 min read/ISO 27001, Audit readiness
ISO 27001 A.8.15 Logging: Which Logs Do You Actually Need to Keep?
A.8.15 asks you to produce, protect and analyse logs of relevant events. Decide which sources and events matter for your risks, and how long and how well each tier is kept.
10 min read/ISO 27001, Audit readiness
SOC 2 is getting its first major rewrite since 2017. Here's what Autenix customers should do now
The AICPA has proposed a 2027 update to the SOC 2 Trust Services Criteria. It would consolidate overlapping criteria, give vendor management more weight, and add AI-specific points of focus. Nothing changes for your next audit yet, but the timeline is short enough to plan around.
3 min read/SOC 2, Audit readiness