.webp?width=2169&height=526&name=Compass%20regular%20transparent%20website%20(1).webp "Compass IT Compliance Logo")
-1.webp?width=2169&height=620&name=Compass%20regular%20transparent%20website%20smaller%20(1)-1.webp "Compass IT Compliance")
How to Read a SOC 2 Report: A Section-by-Section Guide
by Janelle Lewis on August 3, 2026 at 11:30 AM
A few months ago, at an ISACA event, a woman came up to me for help interpreting her organization's SOC 2 report. She had strong business acumen, but she'd been handed the vendor risk function with almost no background in how to actually read one. That conversation stuck with me, beca …
What the 2026 Verizon DBIR Means for Your SOC 2 Compliance Program
by Rachel Hughes on June 10, 2026 at 3:55 PM
The 2026 Verizon Data Breach Investigations Report (DBIR) recently dropped. Vulnerability exploitation is officially the #1 breach vector at 31%. It is now the #1 way attackers are getting in, surpassing credential abuse, which dropped from 22% down to just 13% as an initial access me …
Subservice Organizations in SOC Reports: Carve-Out vs. Inclusive Method
by Rachel Hughes on June 9, 2026 at 4:33 PM
When a service organization relies on another vendor to perform part of its service, that vendor relationship doesn’t disappear from the SOC audit. Think of a payroll processor using a third-party data center, for example, or a SaaS company built on a major cloud infrastructure provid …
Does SOC 2 Reduce Security Questionnaires, or Just Change Them?
by Derek Boczenowski on May 28, 2026 at 11:00 AM
Every B2B vendor chasing enterprise deals eventually asks the same thing. We are pouring real money and real calendar time into a SOC 2 Type 2 report, so will it actually reduce the security questionnaires we get buried under, or will buyers just keep sending them anyway?
What Are Buyers Actually Looking for in Your SOC 2 Type 2 Report?
by Cera Adams on May 22, 2026 at 12:12 PM
You spent six months getting ready for your SOC 2 Type 2 audit. You collected the evidence. You sat through the walkthroughs. You finally got the report, a polished sixtypage document with an unqualified opinion stamped on the front. Then you sent it to your first enterprise prospect. …
The SOC 3 Report: Your Most Underutilized Trust Asset
by Jerry Hughes on April 24, 2026 at 2:03 PM
In today's marketplace, trust is currency. Prospects evaluate vendors with increasing scrutiny, procurement teams demand proof of security controls before signing contracts, and buyers at every level want assurance that the organizations handling their data take that responsibility se …