All Episodes
Framework - SOC 2 Compliance Course — 65 episodes
Welcome to the SOC 2 Audio Course
Episode 64 — Pre-Sales Enablement: Using SOC 2 to Accelerate Deals
Episode 63 — Pentest Scoping, Findings Lifecycle, Remediation Proof
Episode 62 — IaC Guardrails & Policy-as-Code (OPA, conftest, SCPs)
Episode 61 — Mobile App SDLC & App-Store Release Governance
Episode 60 — Multi-Cloud Specifics: AWS/Azure/GCP Control Patterns
Episode 59 — Evidence Retention, Chain-of-Custody, Immutability
Episode 58 — Customer Trust Portals & Controlled Evidence Sharing
Episode 57 — GenAI/ML Services in Scope: Risks, Controls, Evidence
Episode 56 — Designing a Metrics & KRIs Program for SOC 2
Episode 55 — SRE for Availability: SLOs, Error Budgets, Incident Math
Episode 54 — Backup, Restore, and DR Testing at Scale
Episode 53 — Remote Work Security: Home Offices, Travel, Contractors
Episode 52 — Endpoint & MDM Controls for Distributed Teams
Episode 51 — Secrets Management in Code and Pipelines (Deep Dive)
Episode 50 — Key Management & BYOK/KMS Rotations
Episode 49 — Data Residency & Sovereignty in SOC 2 Scopes
Episode 48 — Beyond the Stamp: Turning SOC 2 into Real Outcomes
Episode 47 — Annual Maintenance: Calendars, KRIs, Maturity
Episode 46 — Startup vs Enterprise Right-Sizing
Episode 45 — Pairing with Pen Tests, Bug Bounties, SSDF/SLSA
Episode 44 — Using SOC 2 to Answer SIG/CAIQ/Customer Questionnaires
Episode 43 — Crosswalks: SOC 2 ↔ NIST CSF / ISO 27001 / CIS 18
Episode 42 — Final Report Reviews & Distribution Practices
Episode 41 — Handling Exceptions & Deviations
Episode 40 — Fieldwork Do’s & Don’ts; Request Lists & Walkthroughs
Episode 39 — Readiness Assessments & Gap Closure
Episode 38 — Selecting the CPA Firm & Independence
Episode 37 — Policy-to-Practice Traceability (Text → Proof → Tests)
Episode 36 — CI/CD & Cloud Proofs: Pipelines, Baselines, Diffs
Episode 35 — Audit-Ready Logs & Screenshots: Accept vs Reject
Episode 34 — Ticketing as Evidence (Approvals, Change, Incidents)
Episode 33 — Continuous Control Monitoring & Automation
Episode 32 — Evidence Strategy & Sampling for Type II
Episode 31 — Strong Control Narratives: Before/After Examples
Episode 30 — Cloud & Multitenant Edge Cases (Scope, Tenancy, Regions)
Episode 29 — Evidence for A/C/PI/P: What “Good” Looks Like
Episode 28 — Privacy in Context: SOC 2 vs ISO 27701 vs HIPAA
Episode 27 — Privacy: Notice, Rights, DPIAs, Retention, DSRs
Episode 26 — Processing Integrity: Accuracy/Completeness/Monitoring
Episode 25 — Confidentiality: Classification, Encryption, DLP
Episode 24 — Availability: Capacity, DR, RTO/RPO, Game-Days
Episode 23 — CC12 Physical/Environmental & Remote-First Realities
Episode 22 — CC11 Vendor Risk & Subservice Oversight
Episode 21 — CC10 Data Integrity in Pipelines
Episode 20 — CC9 Incident Management & Communications
Episode 19 — CC8 Change Management & SDLC (incl. IaC Basics)
Episode 18 — CC7 Ops: Config Management, Vulnerability Mgmt, Patching
Episode 17 — CC6 Logical Access: IAM, SSO, MFA, JML
Episode 16 — CC5 Control Design, Reviews, and Monitoring
Episode 15 — CC4 Commitments, SLAs, Regulatory Requirements
Episode 14 — CC3 HR Lifecycle: Hiring, Training, Offboarding
Episode 13 — CC2 Risk Assessment (Method & Cadence)
Episode 12 — CC1 Governance & Tone at the Top
Episode 11 — How to Read a SOC 2 Report
Episode 10 — CUECs Done Right
Episode 9 — Subservice Orgs: Inclusive vs Carve-Out
Episode 8 — Writing the System Description
Episode 7 — Type I vs Type II (and Bridge Letters)
Episode 6 — Program Roadmap & Realistic Timelines
Episode 5 — Control Ownership & RACI Across the Org
Episode 4 — Trust Services Criteria at a Glance
Episode 3 — Scoping: System Boundary, Services, Regions, Tenants
Episode 2 — Do You Need SOC 2 Now? Buyer & Contract Signals
Episode 1 — What SOC 2 Is (and Isn’t)