Home / All Articles
All Articles
OWASP published the 2026 edition of its Top 10 for LLM Applications on August 4, 2026, during Black Hat week, and eight of the ten entries changed position. One got renamed. The message behind the reshuffle is blunt: you won’t build a model that can’t be fooled, so build the application around it in a way that limits the damage when it is. That one idea explains almost every move in the new ranking, and it should change how your team thinks about shipping AI features. This guide walks through the 2026 list in plain English: what each risk means, a real-world example, and what your team can actually do about it, with or without a dedicated security function. What Is the OWASP GenAI LLM Top 10 2026? The OWASP Top 10 for LLM Applications is a community-built awareness document that ranks the ten most critical security risks in applications powered by large language models. The OWASP GenAI Security Project, a global open-source initiative under the OWASP Foundation, maintains it, and the 2026 edition is the third release since the list first appeared in 2023. OWASP, the Open Worldwide Application Security Project, has published risk lists for web applications since 2003, and those lists became the shared vocabulary security teams, auditors, and buyers use to talk about risk. The GenAI LLM Top 10 does the same job for AI. Whether you’re a two-person startup wiring an API into a chatbot or an enterprise running retrieval pipelines, it gives you a common map of what actually goes wrong. One scoping note matters before anything else. The 2026 edition covers the model as a component inside an application: something that accepts input, generates output, and maybe retrieves information. The moment the model becomes an actor, with tools it can call and consequences it sets in motion, the risk shifts to the companion OWASP Top 10 for Agentic Applications from December 2025. Most products now do both, so most teams need both lists. Why the 2026 Update Matters for AI Builders Two things separate this edition from everything OWASP has published on AI so far. First, the methodology changed. Every previous version rested purely on expert consensus, meaning hundreds of practitioners voting on which risks matter most. This time the vote carried 75% of the weight, and the remaining 25% came from analysis of 6,639 real-world AI security incidents pulled from public vulnerability databases and an AI-harm database. It’s the first edition grounded in evidence of what has actually gone wrong rather than expert prediction of what might. Second, the framing changed. The project leads open the 2026 release by telling teams to stop optimizing the model and start optimizing the containment. The industry has spent two years pouring effort into filters, guardrail models, and jailbreak resistance. The 2026 list says: assume those will eventually fail, and make sure that when they do, nothing important breaks. AI security becomes blast radius control rather than perfect prevention. And this isn’t just a security engineer’s document. Developers decide what tools and permissions a model gets. Product owners decide which workflows run without a human in the loop. Founders and ops leads are the ones answering the security questionnaires where these questions now show up. The 2026 edition also ships a mapping appendix that connects every risk to frameworks your customers and auditors already recognize: NIST’s AI Risk Management Framework, MITRE ATLAS, MITRE CWE, and the Agentic Top 10. Insider Note: Enterprise vendor assessments have started asking about the OWASP LLM Top 10 by name. In security questionnaires we complete for clients at Axipro, questions like “describe your controls against prompt injection and excessive agency” began appearing in early 2026, sometimes before the buyer’s own team could explain what they meant. Being able to answer with a mapped control set is becoming a deal-cycle advantage, not just a security exercise. How the 2026 List Differs From Previous Versions The top two entries held their positions. Everything below them moved. Key Shifts Since the 2025 Update Excessive Agency jumped from sixth to third, the biggest promotion on the list. In 2025, giving a model tools and autonomy was mostly a theoretical worry. By 2026, agentic deployments had produced real production incidents, and the community concluded that agency is what decides whether a successful prompt injection is an inconvenience or a breach. Unbounded Consumption rose four places, from tenth to sixth. Inference costs became a real budget line as reasoning models, long outputs, and agent loops multiplied the compute behind a single request. “Denial of Wallet,” where an attacker spends pennies to trigger spend you can’t afford, is now a mainstream finding. Improper Output Handling fell from fifth to tenth. The risk didn’t shrink. It fell because it’s well understood and directly fixable with encoding and validation practices web developers already have. The entries above it are neither. What’s New, Renamed, or Reprioritized System Prompt Leakage became Hidden Context Exposure, and the scope widened a lot. The 2025 entry worried about attackers extracting your system prompt. The 2026 entry covers everything assembled into the model’s context that users aren’t meant to see: system instructions, retrieved policy documents, tool schemas, workflow rules. The guidance is unusually honest for a security document: assume all of it is discoverable, and design so that disclosure costs you nothing. Data and Model Poisoning absorbed fine-tuning subversion. The attack surface for corrupting a model’s behavior runs from pretraining data through fine-tuning pipelines into the retrieval stores RAG systems depend on, and the entry now says so. Misinformation climbed on evidence, not opinion. Practitioners voted it low; the incident data ranked it high. As reported in Help Net Security’s coverage of the release, OWASP also describes a “defense effect” working in the opposite direction on prompt injection: teams block it so effectively that few successful attacks reach public databases, which makes the risk look smaller than the money spent containing it. Signals About Where AI Security Is Heading Read together, the moves point one
For the past two years, enterprise AI risk conversations have centered on a familiar set of concerns: model bias, hallucination, data privacy, and dependency on third-party models. These are real risks, and most organizations now run some version of a governance program to manage them. But something has shifted. Organizations are no longer just deploying AI that generates content for a human to review. They’re deploying AI that acts. Agents now plan multi-step tasks, call APIs, move data between systems, execute transactions, and coordinate with other agents, often with no human checkpoint in the loop. That shift deserves more than a footnote in the existing AI risk category. It deserves its own line in the risk register: Agentic Autonomy Risk. What Is Agentic AI Risk Management? Agentic AI risk management is the practice of identifying, assessing, and controlling the risks created when AI systems take autonomous action on an organization’s behalf. Where traditional AI governance evaluates outputs (accuracy, bias, privacy), agentic AI risk management governs what agents actually do: the tools they call, the permissions they inherit, and the downstream consequences of their actions. That distinction is the reason existing risk registers struggle with agents, and it’s worth unpacking properly. What Agentic AI Actually Changes Traditional AI systems, even generative ones, are advisory. They produce an output such as a summary, a prediction, a draft email, or a classification, and a human remains the last checkpoint before anything happens in the real world. Agentic AI removes that checkpoint. An agentic system doesn’t just produce an answer. It pursues a goal. It decides which tools to call and in what order, then executes those actions directly against live systems: submitting a purchase order, modifying a database record, sending an external communication, or orchestrating a set of sub-agents to complete a broader workflow. Agentic autonomy is the degree to which a system can plan and execute actions without a human explicitly authorizing each step. It’s a spectrum rather than a binary. At one end, the AI drafts and a human approves every action. At the other, the AI operates within broad guardrails and only escalates exceptions. The further an organization moves along that spectrum, the less its exposure looks like software risk and the more it looks like delegated authority risk, the kind normally reserved for employees, contractors, and automated financial systems. Why Existing Risk Registers Miss Agentic AI Risks Most enterprise risk registers were built on a reasonably safe assumption: a human initiates consequential actions, and the technology around that human behaves deterministically. Agentic AI breaks both halves of that assumption at once. A few specific gaps show up quickly when organizations try to map agentic deployments onto existing categories. Operational risk registers assume process failures come from human error or system outages, not from a system independently choosing an unanticipated path to a stated goal. Cybersecurity risk registers are built around unauthorized external access, while an agent problem usually involves an authorized system taking unauthorized internal actions with its own legitimate credentials. Model risk frameworks, borrowed largely from financial services, evaluate output accuracy rather than action consequences, which matters most when those actions can’t be reversed. And third-party risk assessments treat vendors as static entities, not as autonomous agents that might invoke other vendors’ agents on your behalf. See our guide to the NIST AI Risk Management Framework for how output-focused frameworks are structured. The result is a governance blind spot. An organization can be compliant against its AI policy, its cybersecurity policy, and its vendor risk policy, and still have nobody accountable for the specific risk of a system initiating a harmful sequence of actions before anyone notices. Defining Agentic Autonomy Risk Agentic Autonomy Risk is the risk that an AI system, operating with delegated decision-making and execution authority, takes actions that are harmful, non-compliant, or misaligned with organizational intent before adequate human oversight can intervene. Those actions might happen independently or in coordination with other agents. It deserves standing as a named category alongside cybersecurity, operational, legal, financial, and third-party risk because the loss event itself is different. The harm is a completed action in a live system, and it may be difficult or impossible to reverse. The accountability structure is different too: when an orchestrating agent delegates to sub-agents, responsibility for the outcome gets distributed in ways existing ownership models don’t cleanly capture. So is the detection window. Traditional controls assume a human is positioned to catch an error before it compounds, but an agent can execute dozens of dependent actions faster than any human review cycle. 7 Agentic AI Risk Scenarios to Put on Your Register 1. Unauthorized autonomous decision-making. An agent takes an action within its technical permissions but outside its intended business mandate. It adjusts pricing, approves a refund, or modifies a customer record, and no policy ever explicitly authorized that scenario. 2. Goal misalignment. The agent optimizes for a literal interpretation of its objective in a way that diverges from actual business intent, particularly under ambiguous or adversarial inputs. 3. Multi-agent interactions and cascading failures. One agent’s flawed output becomes another agent’s trusted input. A single error can propagate across a chain of agents faster than anyone can detect it, amplifying the original mistake instead of containing it. 4. Excessive tool or system permissions. Agents get provisioned with broad, standing access “to be safe” rather than scoped, least-privilege access tied to specific tasks. A productivity tool quietly becomes a privilege-escalation path. 5. Regulatory non-compliance. Autonomous actions trigger obligations under data protection, financial services, employment, or sector-specific regulation, and they execute without the compliance review a human-initiated process would normally receive. 6. Explainability and accountability gaps. An autonomous action causes harm and the organization can’t clearly reconstruct why the agent chose that path, or establish whether the business owner, the AI governance function, or the vendor is accountable for the outcome. 7. Autonomous third-party actions. A vendor’s agent, integrated into your environment, takes action on your behalf, or your agent acts against a
A SOC 2 penetration test costs between $1,000 and $30,000 for most companies. A typical SaaS scope, meaning one web application, its API layer, and the cloud infrastructure behind it, usually lands between $2,000 and $20,000. Early-stage startups with a narrow scope can get an auditor-accepted test for $1,000 to $8,000, while enterprises with multiple products and hybrid infrastructure regularly spend $20,000 to $50,000 or more. The spread is wide because “penetration test” covers everything from an automated scan with a cover page to weeks of manual testing by senior engineers. Auditors know the difference, and so do the enterprise customers who asked for your SOC 2 report in the first place. This guide breaks down what drives the price, where the hidden costs sit, and how to buy a test that holds up in fieldwork without overpaying for it. What Is SOC 2 Penetration Testing? A SOC 2 penetration test is a simulated attack on your systems, performed by a qualified security professional, scoped to the environment covered by your SOC 2 report. The tester tries to exploit real weaknesses the way an attacker would: broken access controls, injection flaws, misconfigured cloud services, exposed credentials. The output is a report your auditor reads as evidence that your security controls work in practice, not only on paper. That last part matters. A pentest bought for SOC 2 has a second audience beyond your security team. If the report doesn’t map findings to your audit scope, document its methodology, and show remediation, it fails the job you bought it for. We cover the full deliverable in our guide to what a SOC 2-ready VAPT report includes. How Penetration Testing Fits Into SOC 2 Compliance SOC 2 is built on the AICPA’s Trust Services Criteria, and the Security category (the Common Criteria) applies to every report. Penetration testing is the standard way to satisfy CC7.1, which expects you to detect and monitor for new vulnerabilities, and it supports CC4.1, which covers ongoing evaluations of whether controls actually function. The AICPA’s points of focus explicitly mention vulnerability scanning and penetration testing as examples of how companies meet these criteria. In practice, the test slots into your audit timeline as an evidence item. Your auditor will ask for the report, check the test date against the audit period, and review how you handled the findings. Remediation is often scrutinized harder than the test itself, because it shows whether your vulnerability management process runs or merely exists. Is Penetration Testing Required for SOC 2? Strictly speaking, no. The Trust Services Criteria never use the word “mandatory” about penetration testing. You could theoretically satisfy CC7.1 with vulnerability scanning and strong monitoring alone. In reality, almost every auditor expects one, and skipping it invites two problems. First, your auditor may push back during fieldwork or add exceptions to the report. Second, the enterprise buyers reviewing your SOC 2 report increasingly look for pentest evidence specifically, and a report without it raises questions during procurement. Treat the test as effectively required and budget for it from the start of your SOC 2 compliance checklist. How Much Does SOC 2 Penetration Testing Cost? Typical Price Range for SOC 2 Pen Testing Most companies pay $1,000 to $30,000, with the median engagement for a SaaS business sitting around $12,000 to $15,000. Compliance-focused tests at the lower end of the market start around $1,000 to $5,000. Deep manual testing from established firms runs $10,000 to $30,000. Anything quoted below roughly $3,000 is almost certainly automated scanning packaged as a pentest, which auditors are getting better at spotting. Cost by Company Size (Startup, SMB, Enterprise) Company size is a proxy, not the driver. A 15-person company with three products and a legacy on-prem component will pay more than a 200-person company with one tightly scoped SaaS platform. Testers price effort, and effort follows scope. Cost by Test Type (Network, Web App, API, Cloud, Internal/External) Most SOC 2 engagements bundle two or three of these. The common package for a cloud-native SaaS company is web app plus API plus cloud configuration, which is why the $1,000 to $20,000 band comes up so often. Companies with office networks and internal systems in their audit scope add internal network testing, and the price climbs accordingly. Factors That Influence SOC 2 Penetration Testing Cost Scope and Number of Assets Tested Scope is the single biggest cost driver. Every additional application, API endpoint group, cloud account, or network segment adds testing hours. A pentest priced without a scoping call is a pentest priced on guesswork, and the guess usually favors the vendor. Complexity of Application or Infrastructure A simple CRUD app with two user roles tests quickly. A multi-tenant platform with role hierarchies, workflow engines, file processing, and third-party integrations takes far longer, because each of those features creates attack surface a tester has to work through manually. Authentication tiers matter especially: every distinct role needs testing for privilege escalation and cross-tenant data access. Testing Methodology (Black Box, Grey Box, White Box) Black box testing gives the tester nothing but a URL, grey box adds credentials and documentation, and white box adds source code and architecture diagrams. Grey box is the default for SOC 2 and usually the best value, since the tester spends time exploiting rather than discovering. White box costs more upfront but finds deeper issues. Black box sounds rigorous but often wastes paid hours on reconnaissance an attacker would run for free. Depth of Testing and Manual vs. Automated Approaches Automated scanning finds known vulnerability patterns. Manual testing finds business logic flaws, chained exploits, and authorization gaps that no scanner catches, and it’s the part auditors and security-literate customers actually value. The ratio of manual work to automation is the honest explanation for most price differences between two quotes covering the same scope. Tester Credentials and Firm Reputation Senior testers holding OSCP, GPEN, or CREST credentials bill higher rates, and firms with recognized methodologies charge a premium for the credibility their letterhead carries
Two compromised versions of LiteLLM sat on PyPI for roughly 40 minutes on the morning of March 24, 2026. That window was enough to capture secrets from around 434,000 CI/CD pipeline runs across nearly 2,500 organizations, including AWS, Samsung, Cisco, Salesforce, Siemens, and Deloitte. In August, researchers at CloudSEK and Hudson Rock confirmed they had obtained the raw exfiltrated data: a 153GB archive containing 433,909 files of environment variables, cloud keys, Kubernetes secrets, and API tokens harvested live from running pipelines, as covered by Help Net Security’s reporting on the credential archive. If LiteLLM runs anywhere in your stack, or you touch any AI proxy infrastructure at all, you need answers to three things: whether you were exposed, what to rotate first, and whether the rotation you did back in March actually held. That last one matters more than it sounds, because “we rotated everything” has already burned at least one very large company. How the Breach Happened The attack didn’t start with LiteLLM. On March 19, 2026, a threat group called TeamPCP compromised the build pipeline of Trivy, a vulnerability scanner half the industry runs, and pushed a poisoned release. LiteLLM’s own CI pipeline ran Trivy, so the poisoned scanner had legitimate read access to the project’s runner environment. The attackers used that to steal LiteLLM’s PyPI publishing tokens and ship two malicious releases of their own: versions 1.82.7 and 1.82.8. KICS and the Telnyx Python SDK got hit in the same campaign. The payload design is the part worth studying. The malicious package dropped a .pth startup hook into site-packages, so the code ran the moment any Python interpreter started on the machine, whether or not anything imported LiteLLM. From there it harvested environment variables, read local credential files like .aws/credentials and .kube/config, tried to move laterally across Kubernetes clusters, and installed a systemd backdoor dressed up as a generic telemetry service. InfoQ’s coverage of the PyPI compromise put downloads of the compromised release above 40,000. For scale, LiteLLM normally gets downloaded around 3 million times a day. The exfiltration had a nasty fallback, too. According to CloudSEK, stolen data was encrypted and sent to a typosquatted domain, and when that failed, the malware created a public repository inside the victim’s own GitHub account and uploaded the loot as a release asset. Some companies were publishing their own secrets to the open internet and had no idea. Worth Knowing: The malicious code only existed in the PyPI artifacts. The GitHub source repository stayed clean the whole time, so a developer reviewing the code on GitHub saw nothing wrong. Source review isn’t artifact verification. If you don’t check that what the registry serves matches the upstream source, this class of attack is invisible to you. How to Check If You Were Exposed Three checks, from quickest to most involved. 1. Confirm whether the compromised versions ever ran The malicious versions went live on PyPI at 10:39 UTC on March 24, 2026 and got quarantined about 40 minutes later. The project’s advice: treat any install from that day before 16:00 UTC as suspect. Search your lockfiles, pip caches, SBOMs, and container image histories for 1.82.7 and 1.82.8. And check your internal artifact mirrors. An Artifactory or Nexus proxy that cached the bad release in March can keep serving it internally long after PyPI pulled it. Keep the .pth mechanism in mind when you scope this. The question isn’t “which applications import LiteLLM,” it’s “which machines had the package installed at all,” because every Python process on an infected machine triggered the payload. 2. Hunt for persistence Rotation is pointless if the attacker still has a foothold. Check developer machines, CI runners, and containers for unauthorized .pth files in site-packages and for suspicious systemd units, especially anything posing as a system telemetry service. And review activity from March 24 onward, not just the 40-minute window. Persistence is there so the access outlives the infection. Pro Tip: Don’t limit the persistence hunt to live machines. Base container images rebuilt in late March may have baked the payload into every image derived from them since. Scan your image registry for the affected LiteLLM versions and for unexpected .pth files, then trace which running workloads came from flagged images. 3. Check whether your secrets are in the dump Hudson Rock has published a domain lookup tool and is running ethical disclosures for affected organizations, and CloudSEK maintains a high-confidence victim list. Use them, but know their limits. Attribution in this dataset is genuinely hard. One dump with a siriusxm.com committer email actually traced, through its self-hosted GitLab endpoints, to AdsWizz, a SiriusXM subsidiary. And a large share of the dumps are generic pipeline configurations with no identifying domain, email, or server name at all. Absence from a victim list is not evidence of absence. If your pipelines ran the compromised versions, assume exposure no matter what a lookup tool tells you. What to Rotate, in What Order The guidance from both research teams is blunt: treat every secret the LiteLLM environment could reach as compromised. That covers secrets on disk, in memory, injected into CI jobs, and anything retrievable through instance metadata services. Work down by blast radius: Priority Credential type Why it comes first 1 Cloud IAM keys (AWS, GCP, Azure) Direct control of infrastructure, data stores, and billing. This is where attackers monetize fastest. 2 GitHub and GitLab PATs, package publishing tokens These let an attacker poison your releases and turn your company into the next link in the supply chain. 3 Kubernetes service account tokens and kubeconfigs Lateral movement across clusters was built into the payload, not a theoretical risk. 4 Database passwords and third-party API keys Dumped in plain text in the archive, often with no attribution, so nobody will warn you they leaked. 5 AI provider API keys Billing abuse, quota theft, and access to whatever data flows through your LLM routing layer. One word matters more than the rest of this article: revoke, don’t just rotate. That
The EU AI Act names recruitment AI as high-risk. Annex III explicitly lists AI systems used for recruitment, candidate selection, and employment decisions, which pulls CV screeners, video interview platforms, and assessment tools into the most demanding compliance regime the Act contains. The original compliance date for these systems was August 2, 2026. In June 2026, the EU’s Digital Omnibus moved the deadline to December 2, 2027, a 16-month extension that has led many HR and talent teams to shelve the topic entirely. That’s a mistake, for two reasons. First, one rule that directly affects recruitment technology is already in force: the ban on emotion recognition in the workplace has applied since February 2, 2025, and it catches features still shipping in some video interview products today. Second, the deferred obligations didn’t shrink. Conformity assessments, human oversight design, bias monitoring, and documentation all still arrive in full, and the practical work of auditing a recruitment stack, renegotiating vendor contracts, and training hiring teams routinely takes a year or more. Here’s what the EU AI Act actually requires of employers and vendors using recruitment tools, on the timeline that now applies. Why Recruitment Tools Are Classified as High-Risk Under the EU AI Act Definition of High-Risk AI Systems in Hiring The Act takes a list-based approach. Annex III, point 4, designates as high-risk any AI system intended for the recruitment or selection of natural persons, including placing targeted job advertisements, analyzing and filtering applications, and evaluating candidates. The same point covers AI used for decisions on promotion, termination, task allocation, and monitoring of workers, so the classification follows the tool through the entire employment lifecycle, not just the hiring funnel. The reasoning is straightforward: hiring decisions shape access to livelihoods, and algorithmic discrimination in hiring is well documented. The European Commission’s regulatory framework for AI treats employment as one of the areas where an AI error or bias causes serious harm to fundamental rights. That’s the test for the high-risk tier. Types of Recruitment Tools Affected In practice, the high-risk classification captures most of the modern recruitment stack: CV and resume screeners that rank or filter applicants, video interview platforms that score responses or delivery, psychometric and skills assessment tools that produce scores feeding a hiring decision, sourcing and matching algorithms that decide which candidates a recruiter sees, and programmatic job ad targeting systems that determine who sees a vacancy at all. If the system’s output materially influences who advances and who does not, assume high-risk until proven otherwise. Important: Emotion recognition is not high-risk in the workplace. It is prohibited. Article 5 bans AI systems that infer emotions of people in the workplace (outside narrow medical and safety cases), and that ban has applied since February 2025 with the Act’s top penalty tier attached. If your video interview vendor markets “engagement scoring” or “sentiment analysis” of candidates, that feature needs to be switched off for EU hiring now, not in 2027. Recruitment Tools That May Fall Outside High-Risk Classification Not everything in the HR stack qualifies. The Act carves out systems performing narrow procedural tasks that do not materially influence decision outcomes. An applicant tracking system that stores applications, schedules interviews, and sends templated emails is a database with a workflow, not a high-risk AI system. The same goes for tools that transcribe interviews without scoring them, deduplicate candidate records, or generate first drafts of job descriptions for a human to edit. The line is decision influence: the moment a tool ranks, scores, filters, or recommends candidates, it crosses into Annex III territory. Deployers who rely on an exemption must be able to document that assessment, so “we decided it doesn’t count” needs to exist on paper. Extraterritorial Scope: Which Employers Are Covered The Act applies to providers placing AI systems on the EU market and to deployers established in the EU, but it also reaches further: it covers providers and deployers located outside the EU where the output of the system is used in the EU. For recruitment, the consequence is blunt. A US or UK company with no EU entity that uses an AI screener to filter applicants for roles based in Berlin or Dublin, or that screens candidates located in the EU, is using the system’s output in the Union. Brexit doesn’t move UK employers out of scope when they hire into or from the EU. Providers vs. Deployers of Recruitment AI Tools The Act splits obligations between the provider (the vendor that develops the tool and places it on the market) and the deployer (the employer using it). Most employers are deployers, and deployer obligations are lighter but real. One common trap: an employer that substantially modifies a high-risk system, or puts its own name on it, can be reclassified as a provider and inherit the full provider stack. Heavy customization of a screening model, or fine-tuning it on your own hiring data, can be enough to trigger this. Key Obligations for Employers Using AI Recruitment Tools Human Oversight in Automated Hiring Decisions Deployers must assign oversight of the system to people with the competence, training, and authority to intervene. That last word matters. A recruiter who rubber-stamps whatever the ranking algorithm produces, because nobody has time to review 800 rejected CVs, doesn’t count as oversight. Regulators and courts will look at whether the human could genuinely override the system and whether they ever did. Designing review checkpoints where a person can meaningfully change the outcome, and logging when they do, is the core of compliant deployment. Transparency Requirements Toward Candidates Employers must inform workers and their representatives before putting a high-risk AI system into use at work, and candidates subjected to such a system must be told it is being used. In countries with works councils, such as Germany, this obligation lands on top of existing co-determination rights, so employee representatives may need to be consulted before the tool goes live rather than just told afterward. Burying an AI disclosure in a privacy policy paragraph is unlikely to survive scrutiny.
A green dashboard is not an audit opinion. Compliance automation platforms like Vanta, Drata, Secureframe, and Hyperproof have made SOC 2 readiness faster and cheaper, but every audit cycle produces the same pattern: controls that sat at “passing” for months come back from the auditor with exceptions or requests for re-testing. The four controls below account for a disproportionate share of those rejections, and they all fail for the same underlying reason. The tool confirmed that evidence exists. The auditor tested whether the control actually operated. This article walks through each of the four: what auditors reject, why, and how to fix the evidence before fieldwork starts. Why Compliance Tools Show “Passing” But Auditors Still Reject Controls The Gap Between Automated Checks and Auditor Judgment Compliance platforms run continuous control monitoring: API calls that check whether a configuration exists, a document is uploaded, or a task is marked done. That’s real value. It catches drift, keeps evidence in one place, and saves weeks of screenshot collection. An audit is a different exercise. A SOC 2 examination is an attestation performed by a CPA firm under AICPA standards, and the auditor’s job is to form an independent opinion on whether your controls met the Trust Services Criteria. That opinion rests on professional judgment, not on whether an API integration returned a 200 response. What “Passing” Actually Means in Your Compliance Dashboard When a control shows “passing,” the platform is telling you one narrow thing: at the moment of the last scan, an automated test found the artifact or setting it was programmed to look for: MFA enforced in the identity provider, a policy document uploaded, a training campaign sitting at 100%. The test says nothing about whether the underlying process ran the way your control narrative claims it did, or whether it ran that way across the whole audit period. How Auditors Evaluate Controls Beyond the Checkbox Auditors test two dimensions. Design effectiveness asks whether the control, as described, would meet the criterion if it worked as intended. Operating effectiveness, the core of a SOC 2 Type 2 report, asks whether it actually did throughout the audit period. To answer that, the auditor pulls a population (every access review, every change, every new hire in the period), selects a sample, and inspects the evidence item by item. A dashboard status feeds into that process. It doesn’t replace it. Insider Note: Auditors increasingly ask for evidence outside the compliance platform precisely because they know what the platform auto-collects. If every artifact you produce comes from the same tool export, expect the auditor to independently pull the population from the source system and compare. Discrepancies between the two are one of the fastest routes to an exception. Control #1: Access Reviews That Automation Marks Complete but Auditors Reject Why Auditors Reject Automated Access Review Evidence User access reviews sit under the logical access criteria (CC6.1 through CC6.3), and they are the single most common source of audit exceptions we see. The typical failure: the platform generated a user list, someone clicked “complete,” and the dashboard turned green. The auditor then asks a simple question the evidence can’t answer: what did the reviewer actually decide? The Missing Element: Documented Reviewer Judgment An access review is a judgment control. Someone with knowledge of the system must look at each account and confirm the access is still appropriate for the person’s role. A timestamped task closure proves the task was closed. It doesn’t prove anyone assessed anything, and an “approve all” review completed in ninety seconds gets exactly the skepticism it deserves. What Auditors Actually Want to See in Access Review Evidence Auditors look for four things: The full population of accounts at the time of review (including service accounts and admin roles), Evidence of who reviewed it and when, explicit dispositions per account or group (retain, modify, revoke), and Proof that flagged access was actually removed. That last item, the deprovisioning ticket showing revocation within a defined window, is the piece most companies can’t produce. How to Fix Your Access Review Control Before the Audit Assign a named control owner per in-scope system, run reviews quarterly, and require reviewers to record a disposition for every line, not a blanket approval. When access is revoked, link the removal ticket to the review record. If a quarter was missed, don’t backfill it. Document it honestly and show the remediation, because auditors treat fabricated retroactive evidence far more severely than a disclosed gap. Control #2: Change Management Approvals That Pass Automated Scans Why Ticket Closure Isn’t Proof of Approval Change management (CC8.1) automation typically verifies that production changes link to a ticket and the ticket is closed. Auditors test something stricter: that each sampled change was approved by an authorized person before deployment. An approval added after the merge, or a ticket closed by the same engineer who wrote the code, fails that test even though every automated check came back green. The Segregation of Duties Problem Automation Misses Segregation of duties is the requirement that no single person can develop, approve, and deploy the same change. NIST’s SP 800-53 control catalog treats it as a foundational access control principle, and SOC 2 auditors apply the same logic. Small engineering teams trip on this constantly. Self-approved pull requests, admins who can bypass branch protection, direct pushes to main: a scanner sees “changes with tickets” while an auditor sees SoD violations. Emergency Changes and Retroactive Approvals: Common Rejection Triggers Every audit period contains hotfixes. Auditors don’t reject emergency changes. They reject emergency changes with no documented post-hoc review. If your policy says urgent changes get retroactive approval within two business days, the auditor will sample your emergency changes and check exactly that. No policy, or a policy nobody followed, produces an exception. Rebuilding Change Management Evidence Auditors Will Accept Enforce the control technically: branch protection requiring at least one independent reviewer, no admin bypass, and deploy pipelines that only run from protected branches. Then write the emergency change procedure down and generate the review artifact every time it fires.
One in five breached organizations last year traced the incident to shadow AI, and those breaches cost an average of $670,000 more than standard incidents, according to IBM’s 2025 Cost of a Data Breach Report. The worst part is that most of those organizations already ran a CASB, a DLP program, or both. The tools were on, but the traffic still got through. That’s the visibility gap this article is about. AI tool usage tracking isn’t the same problem as SaaS discovery, and the security stack built for the SaaS era misses most of what matters about AI. Below, we break down what tracking actually requires, where CASB and DLP fail, which categories of AI usage slip through, and what a stack that works looks like in 2026. What AI Tool Usage Tracking Actually Means Most teams that say they “track AI usage” mean they can see that someone visited chat.openai.com. That is app discovery, and it answers almost none of the questions a security or governance team actually needs answered. Beyond App Discovery: Tracking Prompts, Data Flows, and Model Interactions Real tracking covers three layers. First, which tools are in use: chatbots, copilots, coding assistants, embedded SaaS features, agents. Second, what data moves: the content of prompts, uploaded files, and pasted context, mapped against data classifications. Third, how models behave in your environment: which endpoints get called, which OAuth grants exist, which agents hold standing permissions. Seeing that an employee opened ChatGPT gets you nowhere. What you actually need to know is whether they pasted a customer contract into a personal account while they were there. The Difference Between Detection, Monitoring, and Continuous Tracking Detection is a point-in-time answer to “what AI is here?” Monitoring watches known tools on an ongoing basis. Continuous tracking is broader: it assumes the inventory changes weekly, correlates identity, data, and endpoint signals over time, and feeds a governance program rather than a one-off report. Frameworks such as the NIST AI Risk Management Framework and ISO 42001 assume the third mode. A discovery scan from last quarter won’t satisfy an auditor, and it certainly won’t slow down an attacker. Why Traditional SaaS Monitoring Falls Short for AI SaaS monitoring was built around a stable premise: an app is a destination with a domain, a login, and an admin console. AI breaks that premise in several ways at once. The risky activity is the content of an interaction, not the visit. The tool often isn’t a destination at all but a feature inside an app you already sanctioned. And increasingly the “user” isn’t a person but an agent acting on delegated credentials. Why CASB Misses Shadow AI Usage The Cloud Access Security Broker sits between users and cloud services to enforce policy, and for classic SaaS governance it still earns its keep. AI has structural blind spots that no amount of tuning can fix. CASBs Were Built for SaaS Apps, Not Model Endpoints A CASB catalog maps domains to applications with risk scores. AI usage doesn’t resolve neatly to a domain. The same api.openai.com endpoint serves a sanctioned enterprise deployment, a developer’s weekend experiment, and a data-leaking browser extension, and the catalog sees one “app”. Meanwhile, new model endpoints, wrappers, and niche AI tools appear faster than any vendor catalog can keep up with. Gartner research from late 2025 found 69% of organizations already suspect or have evidence that employees use prohibited public generative AI tools, catalog or no catalog. Blind Spots in Encrypted API Traffic to LLM Providers Prompt content travels over TLS. Without full TLS inspection, a CASB sees connection metadata: destination, volume, timing. It can’t see that the payload contained source code or patient records. And full TLS inspection is harder than the datasheet implies. Certificate pinning breaks it for many native apps and CLI tools, legal and works-council constraints limit it in the EU, and most organizations carve out broad exemption lists that AI traffic happily rides through. The OAuth and Embedded AI Problem CASBs Can’t See When an employee grants an AI meeting-notes tool access to their calendar and mailbox via OAuth, no proxy is involved at all. The vendor’s servers communicate directly with Microsoft’s or Google’s APIs using a persistent token. The same applies to AI features embedded inside sanctioned SaaS, think Notion AI, Slack AI, or Salesforce Einstein. The CASB sees approved traffic to an approved app, while the AI processing happening inside it, and whichever sub-processor it forwards data to, stays invisible. Personal Accounts and BYO-AI Bypass CASB Proxies Netskope’s 2026 Cloud and Threat Report found that nearly half of employees who use generative AI at work do so through personal accounts. Personal accounts on managed devices are hard enough; personal accounts on personal devices, home networks, and mobile connections never touch the corporate proxy path at all. Tenant restrictions help for a handful of major providers and do nothing for the long tail. Browser-Based and Extension-Delivered AI Escape Network Inspection AI browser extensions read page content and form inputs locally, then exfiltrate via their own backend, often to generic cloud infrastructure that categorizes as “technology” rather than “AI”. From the network’s view, it is routine HTTPS to a CDN. The riskiest interaction, an extension scraping everything an employee views, produces the most boring traffic signature. Insider Note: In AI governance readiness assessments, the OAuth grant review is where clients get the biggest surprise. We routinely find dozens of AI tools holding live mail, calendar, or drive scopes that nobody in IT ever approved, granted by employees who abandoned the tool (and sometimes the company) months earlier. The tokens keep working anyway. Why DLP Fails to Catch Shadow AI Data Exposure DLP has the opposite problem. It can sometimes see content, but it doesn’t understand it, and AI interactions defeat the pattern matching it depends on. Prompt-Based Data Loss Doesn’t Match DLP Signature Patterns DLP fires on signatures: credit card regexes, SSN formats, keyword dictionaries, file fingerprints. Sensitive prompts rarely look like that. “Summarize why we’re losing
Most SOC 2 preparation effort goes into access controls, encryption, and vendor reviews. Then the auditor’s first evidence request arrives, and item one has nothing to do with technology: show us your board charter, your meeting minutes, and proof that your board operates independently from management. That’s CC1.2, and it causes more last-minute scrambling than almost any technical control in the framework. This guide explains what CC1.2 requires, provides a board charter template with sample language that auditors accept, and covers the situation most startups actually face: satisfying the criterion without a traditional board of directors. What Is a SOC 2 Board Charter and Why It Matters for CC1.2 A board charter is a formal document that defines your board’s purpose, composition, authority, meeting procedures, and oversight responsibilities. Outside of compliance, it’s a corporate governance tool and a good idea in general for companies with shareholders. Inside a SOC 2 audit, it’s the primary design evidence for CC1.2, the criterion that asks whether an independent body oversees management and the internal control environment. The charter matters because CC1.2 is one of the few criteria where the control is a document plus behavior. The charter establishes the structure. The auditor then tests whether the structure operates: did the board actually meet, did it review the security program, did it challenge management? A beautifully drafted charter with no meeting minutes behind it fails just as surely as no charter at all. If you’re earlier in your preparation, our complete SOC 2 guide covers how the full audit fits together. Understanding CC1.2: The Board Independence Criterion CC1.2 is part of the Trust Services Criteria published by the AICPA (American Institute of Certified Public Accountants). The criterion requires that the board of directors, in the AICPA’s words, “demonstrates independence from management and exercises oversight” of how internal control is developed and how it performs. That sentence hides two separate tests. Independence means the board isn’t just management wearing a second hat. Active oversight means the board actually reviews and challenges the control environment instead of existing on paper. Plenty of companies pass one and fail the other. How CC1.2 Fits Within the CC1 Control Environment The Common Criteria run from CC1 through CC9, and the CC1 series covers the control environment: the governance and people layer everything else rests on. CC1.1 addresses integrity and ethical values, CC1.2 addresses board independence and oversight, CC1.3 covers organizational structure and reporting lines, CC1.4 covers competence and hiring, and CC1.5 covers accountability. CC1.2 is the layer that makes the other four credible. A code of conduct means little if nobody independent of management ever checks whether leadership follows it. The COSO Principle 2 Connection The Trust Services Criteria are built directly on the COSO Internal Control—Integrated Framework and its 17 principles. CC1.2 maps to COSO Principle 2, which carries four points of focus: the board establishes oversight responsibilities, applies relevant expertise, operates independently of management, and provides oversight of the system of internal control. Those four phrases are worth memorizing, because they’re effectively the outline of a good board charter. Why Auditors Prioritize Board Charter Evidence Auditors test the control environment first because failures there cascade. If governance is weak, every other control claim gets harder to trust: who approved the risk assessment, who reviewed the incident report, who held management accountable when a control slipped? An exception at CC1.2 tells the auditor that nobody independent was watching, and they’ll read the rest of your evidence with that in mind. That’s why board charter requests sit near the top of almost every evidence list. Worth Knowing: Points of Focus Points of focus are not pass/fail requirements. The AICPA describes them as characteristics that assist evaluation, and the 2022 revisions changed points of focus without changing any criteria. In practice, though, they function as the auditor’s mental checklist, so drafting your charter against them is the safest move. What Auditors Actually Look For in a Board Charter Auditors don’t grade prose style. They scan for specific, verifiable commitments. Here’s what they check, roughly in order. Documented Board Independence from Management The charter must state how many members are independent, define what independence means (no operational role, no material financial relationship beyond board compensation or equity), and describe how independence is maintained. “The board includes members independent of management” without a definition is boilerplate; auditors want criteria they can test against actual member profiles. Defined Oversight Responsibilities This is the heart of CC1.2. The charter should explicitly assign the board oversight of internal control, information security, and risk management. If the charter only mentions financial oversight and strategy, it wasn’t written with SOC 2 in mind, and the auditor will notice the gap. Clear Authority and Decision-Making Powers What can the board approve, veto, or demand? Typical provisions include approving the risk management framework, reviewing audit results, approving executive appointments, and requiring management to report on control deficiencies. Authority without teeth reads as decorative. Meeting Cadence and Quorum Requirements The charter should commit to a minimum meeting frequency (quarterly is the common standard) and define a quorum. This clause matters more than founders expect, because it’s the one auditors test directly against your calendar: if the charter says quarterly and you met twice last year, that’s an exception you wrote for yourself. Committee Structures Larger organizations delegate through audit, risk, and compensation committees, each with its own mini-charter. Smaller companies don’t need committees, but if your charter mentions them, they must exist and produce minutes. Never copy a public-company template with a phantom audit committee. Conflict of Interest Provisions A disclosure and recusal process for conflicts, usually paired with an annual attestation. This clause supports the independence claim: independence isn’t a one-time status, it’s maintained through disclosed and managed conflicts. Evidence of Board Member Expertise and Qualifications COSO’s “applies relevant expertise” point of focus means the board should be able to ask probing questions about security and risk, not just finance. Charters increasingly include a skills expectation clause, and
Most Drata reviews are written by Drata’s competitors. Scroll the first page of Google and you’ll find review posts from rival compliance platforms, each one ending with a pitch for their own tool. This one is different, and the bias runs the other way, so let’s put it on the table: Axipro is a Drata Gold Partner, and our consultants configure the platform for clients every week. That means we profit when companies choose Drata. It also means we know exactly where it saves you months, where the invoice grows faster than you planned, and when you should pick something else. This review covers all three. What Is Drata? Drata is a compliance automation platform (the industry calls the category GRC, for governance, risk, and compliance) founded in 2020 in San Diego by Adam Markowitz, Daniel Marashlian, and Troy Markowitz. Its core job: connect to your cloud infrastructure, identity provider, HR system, and code repositories, then continuously test your security controls against frameworks like SOC 2 and ISO 27001, collecting timestamped evidence as it goes. When your auditor shows up, most of the evidence is already packaged. Funding, Valuation, and Market Position Drata has raised $328 million, most recently a $200 million Series C in late 2022 that valued the company at $2 billion. It passed $100 million in annual recurring revenue in early 2025, acquired the trust center platform SafeBase for $250 million the same year, and now serves more than 8,000 customers. In late 2025 it earned a FedRAMP 20x Low Pilot Authorization, which puts it in a small group of compliance platforms cleared through the U.S. government’s modernized FedRAMP review track. Together with Vanta, it’s one of the two platforms almost every compliance buyer shortlists. Who Drata Is Built For The sweet spot is cloud-native companies from seed stage to mid-market: SaaS businesses pursuing their first SOC 2 or ISO 27001, and scaling teams juggling three or four frameworks at once. If your infrastructure lives in AWS, Azure, or GCP and your team uses standard tools like Okta, GitHub, and a mainstream HRIS, Drata’s automation covers a large share of your evidence collection out of the box. The further you drift from that profile (heavy on-prem systems, exotic tooling, air-gapped environments), the more manual work remains. How Drata Works: From Connection to Audit The workflow runs in five stages. First, you connect your tech stack through more than 270 native integrations covering cloud providers, identity, version control, HRIS, MDM, and ticketing. Second, continuous control monitoring kicks in: automated tests run around the clock against your connected systems, checking things like MFA enforcement, encryption settings, and access reviews. Third, automated evidence collection captures timestamped proof each time a test passes, building the evidence library your auditor will draw from. Fourth, when a test fails, remediation workflows and alerts route the issue to an owner through Slack, Jira, or email, with guidance on how to fix it. Fifth, the Audit Hub gives your auditor a scoped login to review evidence directly in the platform instead of trading spreadsheets and screenshots over email. In our client engagements, that last piece cuts back and forth more than any other feature. Auditors ask fewer clarifying questions when they can trace evidence to its source themselves. Drata’s Core Features Reviewed Overview of the Drata platform and compliance management dashboard. Multi-Framework Control Mapping Drata maintains a single control set mapped across every framework you activate. Pass an encryption control once, and it satisfies the corresponding requirements in SOC 2, ISO 27001, and HIPAA simultaneously. For multi-framework programs, this is the feature that pays for the platform. Adding ISO 27001 to an existing SOC 2 program typically starts you at 60 to 80 percent complete rather than zero. The Drata Agent The Drata Agent is a lightweight application installed on employee laptops. It checks device posture: screen lock, disk encryption, password manager, antivirus, OS updates. It reads configuration states, not files, browsing history, or keystrokes. Employees sometimes push back on installing it anyway, which is why we advise clients to communicate what it does and doesn’t see before rollout, not after the first complaint. Companies with an existing MDM like Jamf or Intune can often pull device evidence from that integration instead. Risk Management, Vendor Risk, and the Trust Center The built-in risk register lets you score risks by likelihood and impact and tie them to controls and remediation tasks. Vendor risk management got a genuine upgrade with the August 2025 agentic AI release, which now collects vendor evidence, reviews SOC 2 reports, and drafts risk summaries with far less manual chasing. The Trust Center, built on the acquired SafeBase product, gives you a public page where prospects can review your certifications and policies under NDA. Clients in active enterprise sales cycles tell us it measurably shortens security review, though note it’s a paid add-on at most tiers, not a bundled feature. Policies, Training, and the Rest Drata ships editable policy templates for every major framework, embedded security awareness training with completion tracking, and an API for anything the native integrations miss. The policy templates are a real accelerator for first-time programs, with one caveat we see constantly: teams accept templates wholesale without adapting them, then get flagged in audit when their actual practice doesn’t match their written policy. A template you don’t follow is worse than no template. Supported Compliance Frameworks Drata supports more than 30 frameworks. The ones that matter for most buyers: SOC 2 (Type I and Type II) against the AICPA Trust Services Criteria, ISO 27001, HIPAA (where Drata operationalizes safeguards, since no formal HIPAA certification exists), GDPR under the EU data protection rules, and PCI DSS. Coverage extends to CMMC, NIS2, DORA, FedRAMP, and various NIST standards. You can also build custom frameworks by mapping your own control set, useful for internal standards or customer-specific requirements. What Users Really Say Drata holds a 4.8 out of 5 on G2 across more than 1,100 reviews, the highest score among the
Vanta is worth it for most cloud-native companies chasing their first SOC 2 or ISO 27001. It’s a harder call if you run on-prem infrastructure, have unusual evidence requirements, or a budget that can’t absorb a renewal surprise. That’s the short answer. The longer one comes down to three things: how much of the platform’s automation applies to your stack, what the contract costs by year two, and how much compliance expertise you have in-house. This review draws on Vanta’s 2026 product releases, third-party procurement data, review platforms, and our experience at Axipro as a Vanta partner implementing the platform for clients across SOC 2, ISO 27001, and ISO 42001 engagements. We work inside the tool every week. We also see exactly where it stops working, and a human has to pick up. What Is Vanta? A Quick Overview Vanta is a compliance automation platform that now calls itself an Agentic Trust Platform. It connects to your cloud infrastructure, identity provider, code repositories, HR system, and device fleet, then runs continuous automated tests against the controls your target framework requires. It collects evidence on its own, maps it to controls, and packages the whole thing for your auditor. Vanta at a Glance Founded in 2018, Vanta now serves more than 15,000 customers, from early-stage startups to names like Atlassian, Duolingo, and Icelandair. The platform supports 35+ frameworks, ships 400+ integrations (the deepest library in the category), and runs over 1,400 pre-built automated tests. In 2026, Forrester named Vanta a Leader in The Forrester Wave: Governance, Risk, and Compliance Platforms, Q2 2026, the first time it appeared in the evaluation. Who Vanta Is Built For (Startups, Mid-Market, Enterprise) Startups remain the core market: roughly 58% of Vanta’s G2 reviews come from small businesses, typically SaaS companies that need a SOC 2 report to close their first enterprise deals. Mid-market teams use it to run multiple frameworks off shared evidence. The enterprise push is newer. In March 2026, Vanta shipped an Organizations Center and adaptive business unit scoping, which lets larger companies segment compliance by product, region, or team inside a single workspace instead of duplicating controls across accounts. Frameworks Vanta Supports Coverage includes SOC 2 (Type I and Type II), ISO 27001, ISO 42001 for AI management systems, HIPAA, GDPR, HITRUST, FedRAMP, PCI DSS, and the NIST AI RMF, among 35+ total. The AI governance coverage matters more each quarter: ISO 42001 and NIST AI RMF requests now show up in security questionnaires that had never mentioned AI before 2025. Vanta Key Features Reviewed Overview of the Vanta platform and compliance management dashboard. Continuous Controls Monitoring This is the engine. Vanta’s 1,400+ tests run continuously against AWS, GCP, Azure, Okta, GitHub, and whatever else you’ve connected: are S3 buckets encrypted, is MFA enforced, are background checks done on time, does anyone hold access they shouldn’t? Failing controls get flagged with remediation guidance and SLA tracking, so compliance stops being an annual scramble and turns into something you maintain as you go. Automated Evidence Collection Instead of screenshots and spreadsheet exports, evidence flows in from your integrations and lands on the right controls. Cross-mapping is the underrated part: evidence you collect for SOC 2 gets reused for ISO 27001, HIPAA, or ISO 42001, which is why adding a second framework on Vanta takes weeks rather than months. The Vanta AI Agent (2026 Update) The AI Agent launched in mid-2025 and has moved fast since. In November 2025, Vanta rebuilt it as AI Agent 2.0, the core of the new Agentic Trust Platform, alongside a Risk Graph and Customer Commitments tracking. In March 2026, dedicated agents for compliance, third-party risk, and customer trust workflows. In June 2026, the Vanta Agent for Risk unified internal and vendor risk into one continuously updated view. In practice, the agent scans your program for inconsistencies, drafts policy change summaries for annual reviews, suggests control mappings when you upload policies, validates evidence before audits, and flags questionnaire gaps before they slow a security review. Vanta pitches it as a 24/7 GRC engineer. That’s marketing, but not empty marketing: it takes real hours of tedious work off your plate. Every draft still needs a human review before adoption, and the agent does its best work when a question maps to evidence you already hold. Insider Note: The AI Agent is only as good as its signal. If a large slice of your stack sits outside Vanta’s 400+ integrations, its suggestions shift from precise to generic. Test it against your actual environment during a trial, not a polished demo tenant. Policy, Vendor Risk, and Training Modules Policy templates cover the standard library, with AI-assisted drafting and version tracking. Vendor Risk Management (VRM) is a paid add-on that collects vendor evidence and generates AI risk summaries, feeding the broader third-party risk management picture. Security awareness training is built in, which removes one more standalone tool from the stack. Trust Center and Questionnaire Automation The Trust Center gives you a public page where prospects self-serve your security posture, and questionnaire automation drafts answers to inbound security reviews. Vanta reports automating over 80% of questionnaire responses with up to a 95% acceptance rate and 81% faster review completion. Those are vendor numbers, so apply a discount, but the direction matches what users report. Watch the caps: lower tiers limit automated questionnaires per year, and enterprise sales teams burn through those limits quickly. Access Reviews Access review campaigns pull directly from your identity provider, so quarterly reviews become a guided approval flow instead of a spreadsheet exercise. It’s a strong module; just know it sits in the Plus tier and above, not the entry plan. Vanta Pros and Cons (Honest Breakdown) Pros: Where Vanta Excels The integration library is the deepest in the category, and it shows during onboarding: most tests light up within days for a standard cloud stack. Auditor familiarity is a real, compounding advantage, since most CPA firms know Vanta’s exports and ask fewer clarification questions. Cross-framework evidence reuse
Learn how organizations can use the EU AI Act to build trust, speed up innovation, strengthen procurement, and gain a competitive advantage through effective AI governance. The Biggest Mistake Organizations Make About the EU AI Act When executives hear “EU AI Act,” their first thought is usually: another regulation, another compliance project, another expense. And who could blame them? Between GDPR, DORA, and NIS2, businesses are under real pressure to show they handle technology responsibly. Here’s what most of them miss, though. Complying with the EU AI Act does more than keep you clear of fines. Done well, it becomes a selling point. Companies that treat AI governance as a strategic skill earn customer trust and close enterprise deals faster. That matters because customers, investors, and regulators are asking tougher questions about AI than ever: Can you explain your AI decisions? How do you manage bias? Who’s accountable when something goes wrong? What controls protect sensitive data? The EU AI Act gives you a framework for answering them. When you can show good governance, you satisfy regulators, and you also win over the customers and partners deciding whether to trust you in the first place. That trust is worth real money in the AI era. And good governance doesn’t mean more bureaucracy. It means consistency. With clear ownership, defined risk processes, and transparent documentation, AI projects become easier to run and easier to scale. Teams stop reinventing governance for every new initiative and follow a repeatable framework instead, which speeds up decisions and cuts uncertainty. Companies with mature AI governance are already seeing this play out. They build more customer confidence in their AI products and answer procurement and due diligence requests in days instead of weeks. They run less risk of expensive AI failures or reputational damage, look credible to investors and regulators, and roll out AI consistently across the organization. In a market where trust increasingly drives purchasing decisions, that shows up in revenue. A McKinsey survey on the state of AI found that organizations investing in responsible AI practices are better positioned to capture value as adoption scales. Three Steps to Get Started You don’t need to transform the whole organization at once. Here’s where you can start: First, map your AI environment. Build an inventory of AI systems and know where they’re being used. You can’t govern what you can’t see, and most organizations are surprised by how many AI tools are already in play across teams. Second, spot risk early. Work out which high-risk use cases exist and build governance into the development lifecycle. The EU AI Act classifies systems by risk level, so knowing where your use cases fall tells you exactly how much scrutiny each one needs before it ships. Third, fold governance into existing processes. Add AI governance to your security, privacy, and enterprise risk programs instead of running it as a separate effort. This is where recognized standards like ISO/IEC 42001 pull their weight, giving you a structured management system that slots into what you already have rather than bolting on yet another silo. That’s enough to set your organization up for the long run. The debate around the EU AI Act shouldn’t be about staying on the right side of regulation. It should be about building AI that people trust and that you can actually scale. Organizations that put governance in place now will innovate faster and earn a stronger market reputation while their competitors scramble to catch up. In a few years, the edge will go to the companies that govern AI best, not the ones that use it the most. Is your organization preparing for the EU AI Act? Start by assessing your AI governance maturity and aligning your AI strategy with recognized frameworks like ISO/IEC 42001 and the NIST AI RMF, and turn compliance into a business advantage.
ISO/IEC 27001 certificates nearly doubled in a single year, from 48,671 in 2023 to 96,709 in 2024, according to ISO’s own certification survey. A big share of that jump comes from startups, not enterprises. The reason is simple: buyers stopped taking “we take security seriously” at face value, and a certificate is the fastest way to prove it. This guide covers when a startup should pursue ISO 27001, what it costs, how long it takes, and how a small team gets certified without a dedicated security department. What Is ISO 27001 and Why It Matters for Startups ISO/IEC 27001 is the international standard for information security management. It doesn’t hand you a checklist of firewalls to buy. Instead, it asks you to build and run an Information Security Management System (ISMS): a documented, repeatable way of finding your security risks and doing something about them. Certification means an accredited third party checked that your ISMS works and matches the standard. For a startup, that distinction matters. You’re not being graded on whether you own expensive tools. You’re being graded on whether you can show a system, which is exactly what an enterprise buyer’s procurement team wants to see before they sign. The Core Principles: Confidentiality, Integrity, and Availability Everything in ISO 27001 traces back to the CIA triad: confidentiality, integrity, and availability. Confidentiality means only the right people see the data. Integrity means the data is accurate and hasn’t been tampered with. Availability means the data is there when someone needs it. Every control you put in place, and every risk you assess, ties back to protecting one of those three properties. ISO puts it plainly: an ISMS that meets the standard preserves the confidentiality, integrity, and availability of information by running a risk management process. Keep the triad in mind, and the rest of the framework stops feeling abstract. How ISO 27001 Differs from Other Security Frameworks for Early-Stage Companies SOC 2 is the framework startups usually bump into first, especially when selling into the US. It results in an attestation report from a CPA firm, scoped to specific systems. ISO 27001 is a certification, recognized in over 150 countries, and it covers your whole organization through a formal ISMS with management reviews and company-wide risk assessment. The two overlap heavily. Roughly 70 to 80 percent of the controls line up, so if you do one, the second gets much cheaper. The real difference is structure. SOC 2 checks whether specific controls work. ISO 27001 checks whether you’ve built a management system that keeps those controls working over time. It also aligns closely with GDPR, which is why it travels well in Europe. Insider Note: Auditors can usually tell within an hour whether your ISMS is real or was assembled the week before the audit. A management review meeting with actual notes, decisions, and follow-ups from three months ago is worth more than a perfect-looking policy binder with no evidence anyone ever used it. When Should a Startup Pursue ISO 27001 Certification? The honest answer: when a deal, a market, or an investor is asking for it, or is about to. Certifying purely because it feels responsible is a good way to burn cash and calendar time you don’t have yet. Early-Stage vs. Growth-Stage: Timing the Certification At pre-seed and seed, ISO 27001 is usually early unless you’re selling into regulated industries or the EU from day one. Your product and processes are still shifting, and certifying a moving target means re-documenting everything a quarter later. At Series A and beyond, the math changes. Deals get bigger, buyers get more careful, and investor due diligence starts probing your security posture. Certifying while you’re 15 to 40 people is often the sweet spot: mature enough to have stable processes, small enough that scoping the ISMS is still manageable. When ISO 27001 Might Be Overkill for Your Startup If your customers are US SMBs who only ever ask for SOC 2, leading with ISO 27001 may be solving a problem you don’t have. If you’re pre-revenue and still hunting for product-market fit, your time is better spent shipping. And if no one in your sales pipeline has ever mentioned a certificate, that silence is data. Pro Tip: Pull your Last 20 Security Questionnaires Before you commit, pull your last 20 security questionnaires or RFPs and count how many explicitly asked for ISO 27001 versus SOC 2 versus nothing. That single tally answers the “which framework, and when” question faster than any consultant’s discovery call. Key Benefits of ISO 27001 for Startups Unlocking Enterprise Sales and Bigger Deals The clearest return is revenue you couldn’t touch before. Large buyers often won’t even start a security review without a recognized certificate on file. ISO 27001 gets you past the first gate of enterprise sales, and it shortens the review itself because a big chunk of the questionnaire is already answered by your certification. Building Investor and Board Confidence Certification signals operational maturity. When an investor sees a functioning ISMS, they see a founder who can build systems, not only ship features. That plays well in investor due diligence, where a security gap can stall a term sheet, and it gives your board something concrete to point to on risk. Establishing Customer Trust from Day One A certificate is third-party proof, and third-party proof beats self-assurance every time. For a young company with no brand equity yet, it’s a shortcut to being taken seriously by customers who’ve never heard of you. Creating a Scalable Security Foundation Because ISO 27001 makes you build a system rather than a one-off fix, it scales as you grow. New hires, new products, and new data types slot into an ISMS you already run. You’re not rebuilding security from scratch at every stage. Reducing Long-Term Compliance Costs Adding SOC 2, HIPAA, or ISO 42001 later is far cheaper once an ISMS exists, thanks to that 70 to 80 percent control overlap. The first framework is the expensive one.
Most organizations think their AI governance is further along than it is. McKinsey’s 2026 AI Trust Maturity Survey of roughly 500 organizations found an average maturity score of 2.3 out of 4, and only about a third reported level three or higher in strategy, governance, and agentic AI oversight. Adoption is outpacing control, and regulators have noticed. An AI governance maturity model gives you a way to measure that gap honestly. This guide covers what a maturity model is, the six dimensions it should measure, the five levels most models use, and how to assess your own organization and build a roadmap to the next level. What Is an AI Governance Maturity Model? An AI governance maturity model is a structured framework that describes how capable an organization is at governing its AI systems, usually across five progressive levels. The concept borrows directly from the Capability Maturity Model (CMM) that software engineering has used since the early 1990s: define the capability, describe what it looks like at each stage of development, and score yourself against it. The purpose is diagnosis. A maturity model tells you where governance is strong, where it’s theater, and where it doesn’t exist at all. How It Differs from General AI Governance Frameworks Frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001 tell you what good governance contains: policies, risk assessments, accountability structures, monitoring. A maturity model tells you how well you’re doing those things today. The framework is the destination. The maturity model is the odometer. That distinction matters in practice. Plenty of companies can point to an AI policy document. Far fewer can show that the policy changes what teams actually ship. Why Enterprises Need a Maturity Model Three reasons. First, budget: you can’t prioritize governance investment without knowing which dimension lags. Second, accountability: a maturity score gives boards something concrete to track quarter over quarter. Third, regulation: the EU AI Act and frameworks like ISO 42001 assume a functioning management system, and a maturity assessment is the fastest way to find out whether yours would survive scrutiny. Core Dimensions of an AI Governance Maturity Model A useful model measures more than policy coverage. Six dimensions show up consistently across the credible models, including the IEEE-USA flexible maturity model built on the NIST AI RMF. Strategy and leadership. Does the organization have a stated position on AI risk, an executive owner (increasingly a Chief AI Officer), and board visibility? Gartner’s 2025 polling found 55% of organizations now have an AI board or dedicated oversight committee, which means nearly half still govern by improvisation. Policies, standards, and accountability. Written policies mapped to regulations, a RACI matrix for AI decisions, and clear escalation paths. Many organizations adapt the three lines of defense model from financial risk: the teams building AI, the risk function overseeing them, and internal audit checking both. Data governance and model lifecycle. Training data lineage, quality controls, and lifecycle management from development through deployment, monitoring, and retirement. This is where AI governance meets MLOps, and where mature organizations maintain an AI register, a live inventory of every model and system in production. Risk, compliance, and ethics. Risk classification of AI systems, impact assessments, bias and fairness testing, and explainability requirements. Banks will recognize the DNA of model risk management under SR 11-7 here. People, skills, and culture. Training, role clarity, and whether people outside the governance team actually understand their obligations. Tools, automation, and monitoring. Drift detection, automated policy checks, audit logging, and dashboards. Governance that lives in spreadsheets caps out around level three. The 5 Levels of AI Governance Maturity Level 1: Ad Hoc / Initial AI use happens without oversight. There’s no inventory, no policy, or a policy nobody follows. Shadow AI is common, and risk surfaces only when something breaks publicly. Level 2: Developing / Repeatable Someone has been assigned responsibility. A draft policy exists, a partial inventory exists, and reviews happen for high-profile projects. The practices are repeatable but depend on specific people rather than defined processes. Level 3: Defined / Structured Governance is documented, standardized, and applied across the organization. There’s a governance committee, a risk classification scheme, defined lifecycle gates, and mandatory training. Most organizations pursuing ISO 42001 certification are working to reach and formalize this level. Level 4: Managed / Metrics-Driven Governance produces numbers. Coverage rates, review cycle times, incident counts, and risk reduction are measured and reported to leadership. Controls are enforced by tooling rather than goodwill, and audits confirm the system works as described. Level 5: Optimized / Adaptive Governance improves itself. Monitoring feeds back into policy, controls adapt to new model types (agentic systems being the current test), and the organization anticipates regulatory change rather than reacting to it. Almost nobody is here yet, and that’s fine. Level 5 is a direction, not a deadline. Insider Note: In assessments, the most common self-scoring error is claiming level 3 on the strength of documents alone. If your policy says every model gets a pre-deployment review and your inventory shows 40 models but your review log shows 6, you’re at level 2. Evidence beats paperwork every time, and auditors check the logs first. AI Governance Maturity Matrix The matrix crosses dimensions with levels so you can score each one independently. Organizations are rarely uniform: it’s normal to sit at level 3 on policy and level 1 on monitoring. For scoring, keep the rubric simple: 1 to 5 per dimension, scored on evidence you could show an auditor, not on intentions. Board-level indicators (does the board see AI risk reporting?) and operational indicators (does every production model have a completed impact assessment?) should be scored separately, because they fail independently. How to Assess Your Current AI Governance Maturity Start with a baseline self-assessment. Pull together a cross-functional group covering engineering, legal, risk, security, and the business owners of major AI use cases, and score each dimension against the matrix. Half a day is usually enough for a first pass. For each dimension, the
Most organizations get ISO 42001 certified in 2 to 9 months. Companies that already hold ISO 27001 regularly land in the 2 to 5 month range, while enterprises with sprawling AI portfolios and no existing management system can take 12 months or more. The audit itself only takes days. Almost the entire calendar goes into building and operating your AI Management System (AIMS) long enough to produce evidence an auditor can actually check. That is the short answer. The longer answer depends on your starting point, your scope, and how quickly you can get a certification body on the schedule. This article breaks down the full timeline phase by phase, the factors that stretch or compress it, and what the recertification cycle looks like once you hold the certificate. Typical ISO 42001 Certification Timeline at a Glance ISO/IEC 42001:2023 is the first international standard for AI management systems, published in December 2023. Because it follows the same harmonized structure as ISO 27001 and ISO 9001, the certification process will feel familiar to anyone who has been through a management system audit: build the system, run it, pass a Stage 1 and Stage 2 audit, then maintain it through annual surveillance. Here is how timelines typically break down by company size. Average Timeline for Small Businesses Small companies move fastest because scope stays contained. A startup with two or three AI systems, a handful of decision makers, and short approval chains can finish scoping in a week and get policies signed off in days rather than weeks. The realistic floor for a small business starting from scratch is around 3 months. With an existing ISO 27001 program and a compliance platform already collecting evidence, 2 months is achievable. Average Timeline for Mid-Sized Companies Mid-sized companies usually take 6 to 9 months. The AI inventory is growing, more departments are touching AI systems, and risk assessments have to cover more use cases. Coordination becomes the hidden cost: getting engineering, legal, and product to agree on an AI policy takes longer than writing the policy itself. Average Timeline for Enterprises Enterprises should plan for 9 to 12 months, sometimes longer. The main drivers are AI system sprawl across business units, longer procurement cycles for certification bodies, and audits that take more days. The Stage 2 audit for a large multinational can run two weeks or more on its own, and internal alignment before the audit takes far longer than the audit itself. Breakdown of the ISO 42001 Certification Timeline by Phase The phases below overlap in practice. Treat the durations as effort estimates for a reasonably resourced program, not a strict sequence. Phase 1: Scoping and Gap Analysis (2–4 Weeks) Everything starts with two questions: which AI systems are in scope, and how far is your current governance from what the standard requires? The gap analysis maps your existing policies and controls against the standard’s clauses and Annex A controls, and produces the project plan for everything that follows. Get the scope wrong here and every later phase inherits the mistake. Phase 2: AIMS Design, Leadership, and AI Policy Development (2–4 Weeks) This phase establishes the skeleton of the management system: the AI policy, governance roles, objectives, and the leadership commitments the standard requires. Executive sign-off is the gating item. The documents are not hard to write. Getting senior leadership to formally own AI governance is where programs stall. Phase 3: AI Risk and Impact Assessments (2–6 Weeks) ISO 42001 requires both AI risk assessments and AI impact assessments, and the distinction matters. Risk assessments look at what could go wrong for the organization. Impact assessments look at consequences for individuals and society, which is a newer discipline for most teams. This phase takes longer when you have many AI systems, high-risk use cases, or no prior methodology to adapt. The output feeds directly into your Statement of Applicability (SoA), the document that maps which Annex A controls you have selected and why. Insider Note: Impact assessments are where auditors probe hardest, because they are the most distinctive part of ISO 42001 compared with ISO 27001. A recycled security risk register with “AI” pasted into it will get picked apart in Stage 2. Build the impact assessment methodology properly the first time. Phase 4: Controls Implementation (2–10 Weeks) The longest phase. Here you implement the Annex A controls selected in your SoA: AI system lifecycle documentation, data governance for training data, human oversight mechanisms, transparency measures, supplier management for third-party AI, and so on. Duration depends almost entirely on the gap analysis results. Organizations with mature engineering practices often find they already do much of this and just need to document it. Organizations without formal AI development processes are building from zero. Phase 5: Documentation, Training, and Evidence Collection (2–8 Weeks) Certification requires proof that the system operates, not just that it exists on paper. That means records: training completion logs, risk assessment outputs, review meeting minutes, monitoring reports. This phase runs partly in parallel with implementation, but it cannot be compressed below a certain floor because auditors want to see evidence generated over time, not a folder of documents all created the week before Stage 1. Phase 6: Internal Audit and Management Review (2–4 Weeks) The standard requires an internal audit of the AIMS and a formal management review before the certification audit. This is your dress rehearsal. A good internal audit surfaces nonconformities while they are still cheap to fix. Skipping or rushing it is a false economy that shows up later as Stage 2 findings. Phase 7: Stage 1 Certification Audit (1–2 Weeks) The certification body reviews your documentation and assesses readiness for Stage 2. The audit itself takes 1 to 3 days for most organizations. The auditor examines your scope statement, AI policy, risk and impact assessment methodology, SoA, and internal audit results, then issues findings. The 1–2 week window covers the audit plus the report. Phase 8: Closing Nonconformities (2–4 Weeks) Almost every Stage 1 produces findings.
CMMC requirements started appearing in Department of Defense contracts on November 10, 2025, when the final DFARS rule took effect. By November 10, 2028, the clause at DFARS 252.204-7021 must appear in every solicitation and contract where contractor systems process, store, or transmit Controlled Unclassified Information (CUI). For most of the Defense Industrial Base (DIB), the math is blunt: pass a CMMC assessment or lose eligibility for DoD work. A CMMC readiness assessment is how you find out whether you’d pass before the stakes are real. It’s a structured review of your environment, documentation, and evidence against the requirements of the Cybersecurity Maturity Model Certification, done before you sit for a self-assessment or a Certified Third-Party Assessment Organization (C3PAO) audit. A good one tells you exactly where you stand and what to fix first. This guide covers what a readiness assessment includes, how the process works at each CMMC level, what it costs, how long it takes, and how to pick someone to run one. What Is a CMMC Readiness Assessment? A CMMC readiness assessment is a pre-certification evaluation that measures your organization against the specific requirements of your target CMMC level. It examines your scope, implemented controls, System Security Plan (SSP), Plan of Action and Milestones (POA&M), and the evidence supporting them, then produces a gap analysis and a remediation roadmap. The purpose is simple: surface every deficiency while it’s still cheap to fix. An assessor who finds a scoping error during a readiness review costs you a few weeks of rework. A C3PAO who finds the same error during a certification assessment can cost you the assessment fee, months of delay, and in some cases contract eligibility. How It Differs From an Official C3PAO Audit An official CMMC Level 2 certification assessment is conducted by a C3PAO accredited by the Cyber AB, the official accreditation body for the CMMC ecosystem. The C3PAO’s findings are binding. Results go into the DoD’s assessment systems, and a passing result produces a CMMC status that contracting officers verify before award. A readiness assessment carries no official weight. Nothing gets filed or certified, and a poor result costs you nothing beyond the work needed to fix it. That’s the whole point. It’s the only stage in the entire process where failure is free. There’s also a conflict-of-interest rule worth knowing. A C3PAO cannot provide consulting and remediation services to an organization and then certify that same organization. If a C3PAO helps you prepare, a different C3PAO has to assess you. How It Differs From a Mock Assessment A mock assessment is a dress rehearsal. It simulates the certification assessment itself: assessors interview control owners, request evidence on the spot, and score findings the way a C3PAO would. A readiness assessment is broader and comes earlier, and its job is discovering and closing gaps rather than rehearsing the exam. Most organizations run a readiness assessment first, remediate, then run a mock assessment a few weeks before the real one to see whether staff and evidence hold up under live questioning. How It Differs From a Self-Assessment A self-assessment is a formal CMMC mechanism rather than a preparation exercise. CMMC Level 1 and a subset of Level 2 contracts let organizations self-assess, post the results to the Supplier Performance Risk System (SPRS), and have a senior official affirm compliance annually. That affirmation is a representation to the government, and false or careless affirmations carry False Claims Act exposure. A readiness assessment is the check you run before making that representation, so the number you affirm reflects reality. Why a CMMC Readiness Assessment Matters Avoiding Failed Certification Attempts CMMC Level 2 covers all 110 security controls of NIST SP 800-171, evaluated against 320 assessment objectives. Every objective has to be met for a control to score, and there’s no partial credit. Organizations that skip readiness work routinely walk into certification believing they’re compliant because controls are “mostly” implemented. Mostly implemented scores the same as not implemented. Protecting DoD Contract Eligibility Under the phased rollout that began in November 2025, CMMC status is a condition of award. Prime contractors also have to flow the requirement down to subcontractors that handle Federal Contract Information (FCI) or CUI, and they’ve been pushing their supply chains hard. So a missed certification hurts twice: you lose the immediate contract, and you risk dropping out of a prime’s approved supplier pool during the exact window when those pools are being rebuilt around CMMC status. Reducing Remediation Costs and Delays Gaps found early get fixed on your schedule with your choice of solution. Gaps found during certification get fixed under deadline pressure, often with whatever expensive tooling can be deployed fastest. There’s a conditional CMMC status for organizations that pass with a limited POA&M, but closeout has to happen within 180 days, and only certain lower-weighted controls are POA&M-eligible in the first place. Readiness work keeps you out of that corner. Worth Knowing: The DoD Assessment Methodology The DoD Assessment Methodology weights each NIST SP 800-171 control at 1, 3, or 5 points, deducted from a starting score of 110. The floor is -203. To achieve even a conditional Level 2 status, you need a minimum score of 88. A handful of unmet 5-point controls, such as FIPS-validated encryption or multifactor authentication, can put certification out of reach on their own, so a readiness assessment should always show the point weight attached to every gap. When to Conduct a CMMC Readiness Assessment Before your first self-assessment. If a contract requires a Level 1 or Level 2 self-assessment, run readiness work before you post a score to SPRS. The score you affirm is a legal representation, and it’s far easier to fix the environment than to explain a misstated score later. When contract requirements are approaching. If CMMC language has shown up in a solicitation you plan to bid, or your prime has set a certification deadline, count backward. Remediation after a readiness assessment typically takes six to twelve months for organizations starting
CMMC certification costs between $4,000 and $30,000 at Level 1, $30,000 to $300,000 or more at Level 2, and $100,000 to well over $1 million at Level 3. Most contractors expect the audit fee to be the big number. It isn’t. The formal assessment typically accounts for only 25% to 40% of total spend, with preparation, remediation, and technology upgrades consuming the rest. The stakes changed in late 2025. The final 48 CFR acquisition rule took effect on November 10, 2025, which means CMMC requirements now appear directly in Department of Defense (DoD) solicitations and contracts. Starting in November 2026, Phase 2 of the rollout gives contracting officers the authority to require third-party certification for Level 2 work. If you handle Controlled Unclassified Information (CUI), certification is no longer optional, and the cost question becomes a budgeting exercise rather than a hypothetical. This guide breaks down every major cost category, what moves your number up or down, and how to keep the total under control. What Is CMMC Certification and Why Does Cost Vary? The Cybersecurity Maturity Model Certification (CMMC) is the DoD’s framework for verifying that companies in the Defense Industrial Base (DIB) actually protect the sensitive information they handle. The program, codified in 32 CFR Part 170, builds on the security requirements of NIST SP 800-171 and, at the top tier, selected controls from NIST SP 800-172. Costs vary so widely because you can’t buy CMMC off a shelf. Your environment has to reach a certain state and then stay there. A 15-person machine shop with one well-scoped CUI enclave faces a fundamentally different project than a 500-person prime contractor with CUI flowing through a dozen systems. Your starting security posture, the scope of your assessment boundary, and whether you build internally or hire help all move the total by six figures in either direction. Average CMMC Certification Cost at a Glance The DoD’s own published estimates are instructive. A triennial Level 2 certification assessment, including affirmations, is projected at roughly $105,000 for small entities and $118,000 for larger ones. Those figures cover only assessment and affirmation activities, though. The DoD excludes implementation costs from its estimates on the grounds that NIST SP 800-171 compliance has been contractually required under DFARS 252.204-7012 since 2017. Your real budget has to cover both. CMMC Certification Cost by Level CMMC Level 1 (Foundational) Cost: $5,000 – $30,000 Level 1 covers Federal Contract Information (FCI) and requires 15 basic safeguarding practices drawn from FAR 52.204-21. Because Level 1 permits an annual self-assessment with no third-party auditor, the costs are internal labor, basic tooling, and documentation. Small contractors with reasonable IT hygiene often land near the bottom of the range. The DoD estimates annual Level 1 assessment and affirmation activity at around $6,000 for a small entity, with the remainder of the range driven by any remediation needed to attest honestly. CMMC Level 2 (Advanced) Cost: $50,000 – $300,000+ Level 2 is where most of the DIB lands and where budgets get serious. It requires full implementation of all 110 security requirements in NIST SP 800-171, assessed across 320 individual objectives. For most contracts, a C3PAO (Certified Third-Party Assessor Organization) accredited by the Cyber AB has to conduct the assessment every three years. Market data puts C3PAO assessment fees at $30,000 to $100,000 depending on scope, site count, and complexity. Preparation dwarfs that figure for most organizations. Companies starting from a low maturity baseline routinely spend three to four times the assessment fee on readiness work before an auditor ever shows up. CMMC Level 3 (Expert) Cost: $300,000 – $1,000,000+ Level 3 adds 24 enhanced requirements from NIST SP 800-172 on top of a completed Level 2 certification, and the assessment is conducted by the government’s DIBCAC rather than a commercial C3PAO. DIBCAC charges no assessment fee, but don’t mistake free for cheap. The DoD estimated roughly $41,000 in additional implementation cost for the 800-172 controls alone, and total triennial assessment-related costs in the $146,000 to $159,000 range. Real-world totals run far higher once you account for the advanced tooling, threat hunting capability, and organizational changes Level 3 demands. Only contractors supporting the most sensitive programs need this tier. Worth Knowing: You can’t skip to Level 3. You can’t skip to Level 3. A final Level 2 certification with all POA&M items closed is a prerequisite for the same assessment scope, so Level 3 budgets always include a full Level 2 project first. CMMC Certification Cost Breakdown by Expense Category Gap Assessment and Readiness Planning Costs A gap assessment maps your current environment against NIST SP 800-171 and typically costs $1,500 to $20,000 depending on depth and scope. This is the most valuable dollar you’ll spend in the entire project, because everything downstream is priced off what it finds. Documentation and System Security Plan (SSP) Costs The System Security Plan (SSP) is the cornerstone document of any assessment, mapping every control to your specific implementation. Professionally developed SSPs and supporting policies run $12,000 to $60,000. A weak SSP is one of the most common reasons assessments stall or fail, so this is a poor place to economize. Remediation and Security Control Implementation Costs Closing the gaps is usually the largest line item: $20,000 to $150,000 or more. Multi-factor authentication, logging and SIEM deployment, encryption, access control restructuring, and incident response capability all live here. Organizations with mature security postures spend far less than those starting from scratch. Technology and Infrastructure Upgrade Costs Many contractors move CUI into a dedicated enclave rather than securing their entire network. Enclave platforms typically cost $300 to $400 per user per month. Others upgrade endpoint protection, replace unsupported systems, or migrate to government-grade cloud environments, each with its own licensing and migration costs. C3PAO Assessment and Audit Fees The formal Level 2 assessment runs $30,000 to $100,000, driven by assessor-days, number of sites, and evidence quality. Well-organized evidence directly reduces assessor time and therefore your invoice. Consulting and Advisory Fees Specialist consultants, including Registered Practitioners (RPs) and
After a SOC 2 and ISO 27001 engagement, there are two documents out of the whole pile that actually close deals: the SOC 2 attestation report and the ISO 27001 certificate. Everything else your engagement produces exists to create those two, support them, or keep them alive for another year. Companies routinely ask their auditor for a SOC 2 certificate, which doesn’t exist. They send a prospect their full ISMS documentation when a one-page certificate would have done. They pay for six months of readiness work and then can’t say what they’re holding at the end of it. So here’s the full list. What a SOC 2 engagement produces, what an ISO 27001 engagement produces, what a combined program produces, and who gets to see each one. Understanding SOC 2 and ISO 27001 Engagement Outputs The Core Difference: Report vs. Certificate SOC 2 is an attestation. A licensed CPA firm examines your controls against the Trust Services Criteria under standards set by the AICPA, then writes up what it found and signs an opinion. No certificate. No logo from the AICPA. No pass or fail stamp. What you get is the report, and it usually runs 60 to 120 pages. ISO 27001 is a certification. An accredited certification body audits your Information Security Management System (ISMS) against ISO/IEC 27001:2022, and if you conform, it issues a certificate of registration. The certificate itself is a page or two. All the detail lives behind it, in your ISMS documentation and the audit reports the certification body writes as it goes. SOC 2 Engagement Deliverables The SOC 2 Attestation Report The report is the engagement. The AICPA’s illustrative SOC 2 report lays out the standard structure: auditor’s report, management’s assertion, system description, the Trust Services Criteria in scope, and the controls tested with their results. A Type I covers control design at one point in time. A Type II covers whether those controls actually operated over a period, usually three to twelve months, and most enterprise buyers now won’t accept anything else. Independent Auditor’s Opinion Letter First section of the report, and the first thing anyone experienced turns to. It gives the scope, the examination period, and the auditor’s conclusion. An unqualified opinion means the description held up and the controls worked. A qualified opinion means the auditor found something material, and every serious reviewer will want to talk about it. Management Assertion Your leadership signs a written statement stating that the system description is accurate and that the controls were properly designed and are operating. It reads like a formality, and it isn’t. The auditor’s entire examination runs against what management asserts here, so overstating anything creates real exposure. System Description Usually the longest part of the report, and you write it, not the auditor. It covers the services in scope, your infrastructure, software, people, processes, how data moves, which subservice organizations you depend on, and the complementary user entity controls your customers have to run on their side for your controls to hold up. Trust Services Criteria Applied Security (the Common Criteria) is in every SOC 2. Availability, Processing Integrity, Confidentiality, and Privacy are optional, and the report names exactly which ones you picked. Whatever you decide during scoping ends up printed in a document your customers read for the next several years. Description of Tests of Controls and Results (Type II) The matrix: every control, what the auditor did to test it, and what came back, including exceptions. Reviewers spend most of their time here, because the exceptions tell them things the opinion letter won’t. Bridge Letter / Gap Letter Your report covers a fixed window, so one ending December 31 leaves a hole for a customer doing diligence in June. A bridge letter from your management, not the auditor, confirms that nothing material changed in the control environment between the report’s end date and today. You’ll write these often enough to keep a template. Management Letter and Observations Plenty of auditors also send an internal-only letter covering observations, minor exceptions, and suggestions that never reached the threshold of a qualified opinion. It’s the closest thing to free consulting you’ll get before next year’s audit starts. Insider Note: Ask early whether your auditor issues a management letter, and whether exceptions land in the report body or only in that letter. Firms handle this differently, and the answer decides what your customers see versus what stays behind your firewall. It rarely comes up in the proposal, but it changes how the finished report reads to a buyer. ISO 27001 Engagement Deliverables ISO 27001 Certificate of Registration The document everyone asks for. It names the certified legal entity, states the ISMS scope, identifies the certification body, carries an accreditation mark from a body recognized under the International Accreditation Forum such as UKAS or ANAB, and shows the validity dates. It’s good for three years as long as you pass annual surveillance audits. Read the scope statement carefully, on your own certificate as much as anyone else’s. A certificate covering one office or one product line says nothing about the rest of the business. Statement of Applicability (SoA) After the certificate, this is the document buyers request most. The Statement of Applicability runs through all 93 Annex A controls in ISO/IEC 27001:2022, says which apply to you, justifies the ones you excluded, and records where each stands. Auditors use it as the map of your control environment, and larger customers increasingly want to see it or a summary of it during diligence. Risk Assessment and Risk Treatment Plan Your methodology, the register it produced, and the Risk Treatment Plan showing what you decided to do about each significant risk: mitigate it with a control, transfer it, avoid it, or accept it. ISO 27001 is built around risk, so these documents are what justify every control decision recorded in the SoA. Information Security Management System (ISMS) Documentation The policy and procedure set, plus the operational records that prove any of it happens. Information
The EU AI Act’s transparency requirements take effect on 2 August 2026, and most of the companies they cover still think the rules are not their problem. Article 50 applies to any business that publishes AI-generated content or runs an AI system that talks to people in the EU. That includes the marketing team generating campaign images and the support team running a chatbot. It also covers the AI agents you’ve wired into customer email. Penalties reach €15 million or 3% of total worldwide annual turnover, whichever is higher, and you don’t need an office in Europe to be in scope. If your content or your chatbot reaches EU users, the obligations reach you. In a nutshell: if you publish AI-generated images or video, deploy chatbots or AI agents that interact with EU users, or publish AI-written text on matters of public interest, then yes, the EU AI Act applies, starting 2 August 2026. A quick word on the “AI Act delay” headlines. The Digital Omnibus package did push the high-risk system deadlines back, in some cases by more than a year, but it did not move the deployer obligations in Article 50. Companies that read those headlines and stood down their AI Act work made an expensive mistake, because the rules most likely to touch an ordinary business are the ones that stayed on the calendar. What Article 50 Actually Requires Article 50 of the AI Act sets out transparency obligations in four situations. In plain English: Tell people when they’re talking to AI. Systems designed to interact directly with people — chatbots, voice assistants, and AI agents — must make clear that the user is dealing with AI, unless that’s already obvious. Mark AI-generated content so machines can detect it. Providers of generative AI systems must mark outputs in a machine-readable format, typically through metadata and watermarking, so the content is detectable as artificially generated. Label deepfakes. Anyone deploying AI to generate or manipulate image, audio, or video content that resembles real people, places, objects, or events, and could falsely appear authentic, must disclose that the content is artificial. Label AI-generated text on matters of public interest. Text published to inform the public must carry a label if AI-generated or manipulated, unless a human reviewed it and a person or organization holds editorial responsibility for it. Article 50 also covers emotion recognition and biometric categorization systems, which carry their own disclosure duties. Far fewer businesses run into those, so this article sticks to the four above. The distinction running through all of this is provider vs deployer. The provider builds or supplies the AI system. The deployer uses it professionally. Most companies reading this are deployers. If You Use AI-Generated Images Realistic AI images sit closer to the deepfake rules than most marketing teams assume. The Act’s definition covers content depicting people, objects, places, and events that could falsely appear authentic to a viewer, which describes a large share of what image generators produce for campaigns, social posts, and landing pages. So what does “clearly and distinguishably labeled” mean? The threshold is best described by its failures: a tiny disclosure hidden in the website footer doesn’t qualify. Neither does a faint label on an image, a label that flashes for an instant in a video, or a disclosure buried in your terms and conditions. The label has to be visible right where someone sees the content, and it has to meet accessibility standards so people with disabilities can perceive it too. The Code of Practice proposes a standardized “AI” visual label, localized per language (“KI” in German, “IA” in French). It also draws a useful line between fully AI-generated content and AI-assisted content, with lighter requirements for the latter. A designer who used AI to extend a background is in a different position from a team publishing a fully synthetic image of a person who doesn’t exist. Important: The deepfake duty doesn’t care about intent. A flattering, harmless AI image of your CEO at an event that never happened is still a deepfake under the Act. Marketing teams generate this kind of content casually. From August, every one of those images needs a label. If You Deploy AI Agents or Chatbots The rule itself is simple: people must know they’re dealing with AI. The provider carries the design obligation, but as the deployer you’re the one putting the system in front of your customers, and you’re the one an EU regulator will contact if your branded assistant pretends to be human. The Act contains an exception for cases where it’s “obvious” the user is talking to AI, judged from the perspective of a reasonably well-informed and observant person. Don’t lean on it. What’s obvious to your product team isn’t obvious to every customer, and the human-sounding voice agents and email-writing AI agents rolling out right now are designed specifically to not feel like software. If an AI agent negotiates a renewal over email or handles a support ticket end to end, disclose it. Pro Tip: Put the Disclosure at the Start of the Interaction Put the disclosure at the start of the interaction, in the interface itself: “You’re chatting with an AI assistant.” A line in your privacy policy doesn’t meet the standard, and a disclosure that appears after the conversation ends is worthless. For voice agents, say it up front in the greeting. What Your AI Vendors Owe You The machine-readable marking obligation in Article 50(2) sits with providers — the companies supplying your generative AI tools. The final Code of Practice expects providers to apply at least two layers of marking where necessary, such as embedded metadata combined with watermarking, and to offer detection mechanisms so deployers, authorities, and researchers can verify whether a piece of content came from AI. One timing caveat: the Digital Omnibus gives generative AI systems already on the market before 2 August 2026 until 2 December 2026 to comply with the marking requirement. Every other Article 50 obligation stays on
The CNIL‘s screening rule sounds simple: hit two of the nine high-risk criteria, and you owe a full Data Protection Impact Assessment (DPIA). The trouble starts when you hit one or none, because the GDPR never says that skipping the DPIA means skipping assessment altogether. Plenty of processing falls outside the CNIL’s screening rules: operations below the two-criteria threshold, activities on the CNIL’s exemption list, processing already covered by an earlier DPIA, and controllers who answer to a different supervisory authority altogether. In every one of those cases, the Article 35 GDPR DPIA obligation may fall away while the risk assessment obligations under Articles 24 and 32 stay exactly where they were. This article maps the scenarios where CNIL criteria don’t apply and what a defensible assessment strategy looks like when they don’t. DPIA vs General Risk Assessment: Core Distinctions Under GDPR These two assessments get conflated constantly, and the mix-up has real consequences. They rest on different legal bases, serve different purposes, and trigger under different conditions. Article 35 GDPR requires a DPIA where processing is “likely to result in a high risk” to people’s rights and freedoms, and it requires the assessment before processing begins. The DPIA looks outward. It evaluates the necessity and proportionality of the processing and the risks it creates for data subjects: discrimination, identity theft, financial loss, reputational damage, loss of control over personal data. The measuring stick throughout is harm to people. Article 32 GDPR requires controllers and processors to put in place technical and organizational measures (TOMs) appropriate to the risk of the processing. You can’t know what’s appropriate without assessing that risk first, so Article 32 carries an implicit risk assessment duty for every processing operation you run, high risk or not. Its focus is security: the confidentiality, integrity, availability, and resilience of the systems handling personal data. Article 24 completes the picture by making the controller responsible for implementing measures proportionate to risk and able to demonstrate compliance. That’s the accountability principle at work. So risk assessment is universal, and the DPIA is the escalated version you reserve for processing that crosses the high-risk line. The real question is which assessment to run and how deep to go. You don’t need a six-figure budget to be GDPR compliant. You need a clear plan and someone to do the work. Affordable GDPR Compliance Services Book a Free GDPR Consultation The CNIL Criteria: A Quick Recap The Article 35(3) Baseline and the 9 Criteria Article 35(3) names three situations where a DPIA is always mandatory: systematic and extensive automated evaluation of individuals, including profiling, with legal or similarly significant effects; large-scale processing of special categories of data (Article 9) or criminal conviction data (Article 10); and large-scale systematic monitoring of a publicly accessible area. Beyond those, the WP29 guidelines on DPIAs (WP248 rev.01), endorsed by the European Data Protection Board (EDPB), list nine criteria that indicate likely high-risk processing: evaluation or scoring, including profiling; automated decision-making with legal or similarly significant effect; systematic monitoring; sensitive data or data of a highly personal nature; processing on a large scale; matching or combining datasets; data concerning vulnerable data subjects (employees, patients, children); innovative use or application of new technological or organizational solutions; and processing that prevents data subjects from exercising a right or using a service or contract. The “Two Criteria” Threshold Rule The CNIL’s position is that processing meeting at least two of the nine criteria requires a DPIA as a general rule. WP248 leaves room on both sides of that line: a controller can conclude that processing meeting two criteria still isn’t high risk, and in some cases a single criterion is enough to trigger the obligation. Either way, the reasoning has to be documented. Where there’s genuine doubt, the CNIL’s advice is simple: do the DPIA. CNIL’s List of Processing Operations Requiring a DPIA The CNIL also maintains a mandatory list under Article 35(4), adopted through Deliberation No. 2018-327 of October 11, 2018. It names 14 types of processing that require a DPIA outright, including systematic employee monitoring, whistleblowing schemes, profiling that can exclude people from a contract, and large-scale processing of health data. If your processing appears on this list, you can skip the criteria math because the DPIA is mandatory regardless. Insider Note: The CNIL’s sectoral “referentials” do more work than most DPOs realize. If your processing fully complies with an applicable referential, the CNIL accepts the position that residual risk isn’t high, which takes Article 36 prior consultation off the table. Checking for a referential before scoping a DPIA can remove the most painful step of the entire process. When CNIL Criteria Don’t Apply: Key Scenarios Processing Falling Below the Two-Criteria Threshold Most B2B processing lives here. A standard CRM, a newsletter list, routine supplier management: these might touch one criterion (large scale, perhaps) without hitting a second. No DPIA is required, but the screening itself is a compliance artifact. Record which criteria you tested, what you concluded, and why. If the CNIL inspects, the absence of a DPIA is defensible only when the screening decision is on paper. Operations on CNIL’s Exemption List Article 35(5) lets supervisory authorities publish “whitelists” of processing that doesn’t require a DPIA. The CNIL adopted one in 2019 after an EDPB opinion, covering categories such as routine HR management in organizations with fewer than 250 employees (without profiling, biometrics, or sensitive data), badge-based physical access control without biometrics, and time management systems that don’t process biometric data. France is one of only a few member states with a formal whitelist, which matters for cross-border groups: the same HR system can be exempt in France and assessable case by case in Luxembourg. Processing Authorized by Specific Legal Provisions Article 35(10) carves out processing based on a legal obligation or public interest task under Article 6(1)(c) or (e), where the legal basis regulates the specific operation and a general impact assessment was already carried out when that law was adopted. It’s a narrow
Only one of these three vendors sells a FedRAMP-authorized identity platform you can buy today as a defense contractor, one sells two of them, and one sells none. Whether that matters for your CMMC Level 2 assessment depends entirely on whether your identity provider stores, processes, or transmits Controlled Unclassified Information (CUI), or provides security protections for the systems that do. That second condition is where most contractors get the analysis wrong. The IdP question is arguably the most argued-about scoping decision in CMMC 2.0 Level 2 preparation, because an identity provider almost never holds CUI directly, yet it controls access to everything that does. This article works through the regulatory requirement, the actual FedRAMP status of JumpCloud, Okta, and Microsoft Entra ID, and how to choose based on your CUI architecture rather than vendor marketing. Understanding the CMMC Level 2 + FedRAMP Requirement What CMMC Level 2 Requires for Cloud Services Handling CUI CMMC 2.0 Level 2 requires contractors to implement the 110 security requirements of NIST SP 800-171 Rev. 2 and, for most contracts, pass a third-party assessment by a Certified Third-Party Assessor Organization (C3PAO). The 48 CFR acquisition rule took effect on November 10, 2025, which means CMMC clauses now appear in new Department of Defense (DoD) solicitations, with third-party assessment requirements expanding through the phased rollout in 2026 and beyond. The cloud piece comes from the CMMC program rule at 32 CFR Part 170. If an Organization Seeking Certification uses a Cloud Service Provider (CSP) to process, store, or transmit CUI, that cloud service offering must be either FedRAMP Authorized at the Moderate baseline or higher or must meet security requirements equivalent to the FedRAMP Moderate baseline. Your C3PAO verifies this during the assessment. If your in-scope CSP fails the test, you fail the assessment. The DFARS 252.204-7012 “FedRAMP Moderate or Equivalent” Clause The requirement predates CMMC. DFARS 252.204-7012 has required since 2016 that any external CSP used to store, process, or transmit covered defense information meet security requirements “equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” For years, “equivalent” was undefined, and contractors interpreted it loosely. The DoD CIO closed that door with its December 2023 equivalency memo. To be FedRAMP Moderate Equivalent, a CSP must now demonstrate 100% compliance with the FedRAMP Moderate baseline, validated by a FedRAMP-recognized Third-Party Assessment Organization (3PAO), and hand over a full Body of Evidence to the contractor. No open Plans of Action and Milestones (POA&Ms) against the baseline are permitted. In some ways, it’s stricter than authorization itself, since authorized CSPs are allowed to carry POA&Ms. Important: A vendor telling you they are “NIST 800-171 compliant” or “aligned to FedRAMP controls” does not satisfy DFARS 7012 or the CMMC rule. Either the offering appears on the FedRAMP Marketplace at Moderate or higher, or the vendor gives you a 3PAO-attested Body of Evidence demonstrating full equivalency. Anything else is a gap your C3PAO will find. When an Identity Provider Falls Under This Requirement An IdP is a cloud service. The question is whether it processes, stores, or transmits CUI. In a typical SSO flow, the IdP handles credentials, authentication tokens, session data, and directory attributes. None of that is CUI in most environments. So a literal reading says the FedRAMP mandate doesn’t apply. The complication is the CMMC scoping guidance, which defines Security Protection Assets (SPAs): assets that provide security functions to the CMMC assessment scope even if they never touch CUI. An IdP enforcing multi-factor authentication (MFA), conditional access, and session policy over your CUI enclave is the textbook SPA. SPAs are in scope for your assessment and get evaluated against the relevant NIST SP 800-171 requirements they help satisfy. Let Axipro help you build a business continuity plan that’s practical, compliant, and audit-ready. Schedule Your Free Assessment Today Schedule A Consultation Does Your Identity Provider Actually Need to Be FedRAMP Authorized? When the IdP Processes, Stores, or Transmits CUI Some architectures do push CUI through the identity layer. If usernames or directory attributes contain CUI (think program names or export-controlled project identifiers), if your IdP proxies application traffic through a gateway that carries CUI payloads, or if CUI-bearing documents get attached to identity workflows, the IdP is now a CSP handling CUI. FedRAMP Moderate or equivalent becomes non-negotiable. When the IdP Provides Security Protections for CUI (SPA Role) This is the common case, and it’s genuinely gray. The FedRAMP requirement in the rule text attaches to CSPs that process, store, or transmit CUI. A pure-play authentication service that does neither is an SPA, not a CUI-handling CSP. Under the final CMMC rule, External Service Providers (ESPs) that handle only Security Protection Data, such as configuration data, logs, and credentials, do not themselves require FedRAMP authorization or a separate CMMC certification. Their services get assessed as part of your assessment. In practice, C3PAOs are not uniform on this. Some accept a well-documented System Security Plan (SSP) showing the IdP never touches CUI. Others take a conservative view that authentication data for CUI systems is sensitive enough that they want FedRAMP-grade assurance behind it, and they will probe hard. DIBCAC’s historical position, given publicly by officials as far back as 2020, is that clouds with management access to CUI systems don’t need FedRAMP unless CUI actually moves into them. That position helps, but you carry the burden of proving CUI never transits the service. Cases Where a Commercial IdP May Be Acceptable A commercial, non-FedRAMP IdP can survive a CMMC Level 2 assessment when all three of the following are true: CUI demonstrably never touches the IdP, the IdP is documented as an SPA with the specific 800-171 requirements it supports, and the data flows in your SSP prove the boundary. This is exactly how many contractors run enclave strategies, keeping a commercial identity stack for the corporate network while the CUI enclave uses its own FedRAMP-authorized identity. The “External Service Provider” (ESP) Classification Under CMMC The final
An AI agent that can read your inbox, query your CRM, and dig through internal documents has more standing access than most of your employees. It handles sensitive data, acts on its own, and often passes that data through sub-processors you’ll never see. Certifications are the quickest way to tell which vendors have let an outsider check their work, and which ones just put the word “secure” on a landing page. No single certificate proves an AI agent is safe. But the right mix of security attestations, privacy certifications, and AI governance standards tells you the vendor has real controls, that an independent auditor has tested them, and that someone is on the hook when the agent misbehaves. This guide covers which certifications to ask for, how to verify them, and which claims should make you walk away. The Core Certifications Every Secure AI Agent Vendor Should Hold SOC 2 Type II SOC 2 Type II is the baseline for any SaaS or AI vendor that handles customer data. A licensed CPA firm audits the vendor against the AICPA’s Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy) and reports on whether its controls actually worked over a review period, usually 3 to 12 months. A Type I report only confirms the controls existed on one particular day. For an AI agent vendor, insist on Type II. Anything less tells you nothing about how the company runs day-to-day. ISO/IEC 27001 ISO/IEC 27001 certifies that the vendor runs a formal information security management system (ISMS): documented risk assessments, defined controls, internal audits, and management review, all verified by an accredited certification body. It’s the most widely recognized security certification outside the US and often a hard procurement requirement in Europe, the UK, and the Gulf. A vendor with international customers should hold it alongside SOC 2, not instead of it. ISO/IEC 27701 (Privacy Information Management) ISO/IEC 27701 extends ISO 27001 with a privacy information management system (PIMS). It maps closely to GDPR concepts like controller and processor obligations, consent, and data subject rights. Almost every AI agent processes personal data at scale, and ISO 27701 is a decent signal that the vendor has built privacy into how it operates instead of delegating it to a policy PDF. ISO/IEC 42001 (AI Management Systems) ISO/IEC 42001 is the first certifiable international standard for AI governance. According to the International Organization for Standardization, it sets out requirements for building and maintaining an AI management system (AIMS): AI risk management, AI system impact assessments, lifecycle management, and oversight of third-party suppliers. For an AI agent vendor, this is the one that covers what SOC 2 and ISO 27001 don’t: how the vendor governs model behavior, training data, and the wider impact of autonomous systems. Worth Knowing: ISO 42001 certificates only started appearing in volume in 2024, and the accreditation ecosystem is still catching up. Check that the certificate came from a certification body accredited for ISO 42001 specifically (under ANAB or UKAS, for example), not just one accredited for ISO 27001. HIPAA (for Healthcare AI Agents) If the agent touches protected health information (PHI), the vendor has to comply with the HIPAA Privacy and Security Rules and sign a Business Associate Agreement (BAA). There’s no official HIPAA certification, so vendors prove compliance through third-party assessments, a SOC 2 with HIPAA mapping, or HITRUST CSF certification. A vendor that won’t sign a BAA has disqualified itself for healthcare work. PCI DSS (for Payment-Handling AI Agents) AI agents that process, store, or transmit cardholder data (think agents automating billing, refunds, or checkout) fall under PCI DSS. Ask for the vendor’s Attestation of Compliance (AOC) and check whether a Qualified Security Assessor validated it or the vendor assessed itself. The current version is PCI DSS 4.x, so an AOC that still references 3.2.1 is out of date. FedRAMP (for Government-Facing AI Agents) FedRAMP authorization is mandatory for cloud services sold to US federal agencies. Authorizations come at Low, Moderate, and High impact levels, and every authorized service appears on the public FedRAMP Marketplace. If a vendor claims FedRAMP status and isn’t in the Marketplace, either the claim is false or the service is still “in process,” and those are very different things. State and local buyers should look for StateRAMP instead. Worth Knowing: ISO 42001 Certificates ISO 42001 certificates only started appearing in volume in 2024, and the accreditation ecosystem is still catching up. Check that the certificate came from a certification body accredited for ISO 42001 specifically (under ANAB or UKAS, for example), not just one accredited for ISO 27001. HIPAA (for Healthcare AI Agents) If the agent touches protected health information (PHI), the vendor has to comply with the HIPAA Privacy and Security Rules and sign a Business Associate Agreement (BAA). There’s no official HIPAA certification, so vendors prove compliance through third-party assessments, a SOC 2 with HIPAA mapping, or HITRUST CSF certification. A vendor that won’t sign a BAA has disqualified itself for healthcare work. PCI DSS (for Payment-Handling AI Agents) AI agents that process, store, or transmit cardholder data (think agents automating billing, refunds, or checkout) fall under PCI DSS. Ask for the vendor’s Attestation of Compliance (AOC) and check whether a Qualified Security Assessor validated it or the vendor assessed itself. The current version is PCI DSS 4.x, so an AOC that still references 3.2.1 is out of date. FedRAMP (for Government-Facing AI Agents) FedRAMP authorization is mandatory for cloud services sold to US federal agencies. Authorizations come at Low, Moderate, and High impact levels, and every authorized service appears on the public FedRAMP Marketplace. If a vendor claims FedRAMP status and isn’t in the Marketplace, either the claim is false or the service is still “in process,” and those are very different things. State and local buyers should look for StateRAMP instead. Regulatory Frameworks AI Agent Vendors Must Comply With Certifications are voluntary. Regulations aren’t. A credible AI agent vendor should be able to explain, in writing, how it meets
One in five organizations has already suffered a breach traced back to shadow AI. Meanwhile, 63% of breached organizations either have no AI governance policy at all or are still drafting one. Below is a complete, copy-ready shadow AI policy template with twelve sections, plus guidance on adapting it for your company size, your industry, and the regulatory frameworks you answer to. The template assumes one hard truth up front: your employees are already using unapproved AI tools. A policy that pretends adoption hasn’t started yet fails on day one, so this one starts from the assumption that it has. What Is a Shadow AI Policy? A shadow AI policy is a formal document that defines how your organization discovers, evaluates, approves, and governs AI tools that employees adopt outside official IT channels. The term borrows from shadow IT, the older problem of unsanctioned software and hardware, but the AI version carries sharper risks: data pasted into a public model may be retained, used for training, or exposed in ways the organization can’t reverse. The policy does three jobs: it separates approved use from unapproved use, gives employees a fast and visible way to request new tools so the sanctioned route beats the workaround, and spells out what happens when someone crosses the line, including how the organization detects it and responds. Shadow AI Policy vs. General AI Acceptable Use Policy Many organizations already have an AI acceptable use policy (AUP) and assume it covers shadow AI. It usually doesn’t. An AUP tells employees how to behave inside approved tools. A shadow AI policy governs the tools themselves: which ones exist in your environment, which ones are allowed, and what happens with the rest. You need both. The AUP handles conduct; the shadow AI policy handles inventory and control. If you only have room for one document, fold the AUP’s data-handling rules into Section 6 of the template below. The Shadow AI Policy Template (Download Link and Copy-Ready Sections) We’ve created a compliance safe template for Shadow AI Policy, use the link below to create a copy and customize for your company: Download The Shadow AI Policy Template → Copy the sections below into your policy management system and replace the bracketed placeholders. The language is plain on purpose. Legalese gets skimmed. Section 1: Purpose and Scope This policy governs the acquisition, approval, and use of artificial intelligence tools, features, and services at [Company]. It applies to all employees, contractors, interns, and third parties with access to [Company] systems or data. It covers standalone AI applications, AI features embedded in existing software, browser extensions, AI agents, APIs, and personal AI accounts used for work purposes, on both corporate and personal devices. The purpose of this policy is to enable productive AI use while protecting [Company] data, customers, and legal obligations. This policy does not prohibit AI. It prohibits ungoverned AI. That last sentence matters. Employees read the purpose statement first, and it decides whether they see the policy as an enabler or a blocker. Section 2: Definitions and Terminology Shadow AI: any AI tool, feature, agent, or service used for work purposes without formal approval under this policy. Approved AI Tool: an AI tool listed in the Approved AI Tools Registry (Section 4) and used under a [Company]-managed account. Personal AI Account: an account on any AI service registered to a personal email address or paid for personally. AI Feature: AI functionality embedded within otherwise approved software (e.g., an AI assistant added to a project management tool), which requires separate evaluation. Sensitive Data: data classified as [Confidential] or [Restricted] under [Company]‘s data classification policy, including the prohibited data classes in Section 6. Define “AI feature” explicitly. Vendors now ship AI additions into already-approved SaaS products every month, and without this definition, those features inherit approval they never earned. Section 3: Roles and Responsibilities The CISO (or designated security lead) owns this policy, maintains the Approved AI Tools Registry, and runs the approval workflow. Department heads ensure their teams know the policy and surface tool requests rather than suppressing them. Legal and Compliance review tools that touch regulated data or fall under the EU AI Act, GDPR, HIPAA, or client contractual restrictions. IT operates detection and monitoring controls (Section 9). Every employee is responsible for using only approved tools for work, reporting unapproved AI use they discover, and requesting new tools through the workflow in Section 7 rather than adopting them directly. Insider Note: In organizations under roughly 200 people, the “CISO” in this section is often the same overworked IT lead who manages laptops. Name a real person, not a title that doesn’t exist yet. A policy that assigns duties to a phantom role is unenforceable, and auditors notice. Section 4: Approved AI Tools Registry [Company] maintains a registry of approved AI tools at [location/URL]. For each tool, the registry records: tool name and vendor, approved use cases, prohibited use cases, permitted data classes, account type (enterprise/team/individual), data retention and training settings, risk tier (Section 5), approval date, and next review date. Only tools listed in the registry may be used for work. Tools not listed are unapproved by default. The registry is reviewed [quarterly]. Keep the registry somewhere employees actually look, such as your intranet homepage or IT help center, not buried in a GRC platform they can’t access. An invisible registry recreates the problem the policy exists to fix. Section 5: Risk Tier Classification (Low, Medium, High) Each tool in the registry is assigned a risk tier. Low: the tool processes only public or internal non-sensitive data, runs under an enterprise agreement with training opt-out, and produces output that a human reviews before use. Approval by IT Security alone. Medium: the tool processes internal business data or connects to [Company] systems via API or integration. Approval by IT Security plus the data owner. High: the tool processes sensitive data, customer personal data, or regulated data; makes or influences consequential decisions (hiring, credit, medical, legal); or operates autonomously
Legacy threat modeling frameworks such as STRIDE were designed for software that behaves the same way over and over again. Agentic AI does no such thing. It can rewrite its own plan mid-task, call external tools, negotiate with other agents, and produce a different output from identical input. MAESTRO exists because none of the legacy threat modeling frameworks were built to handle that. MAESTRO stands for Multi-Agent Environment, Security, Threat, Risk, and Outcome. It is a seven-layer threat modeling framework created specifically for agentic AI systems, and it has become the closest thing the industry has to a standard method for reasoning about agent security. Understanding MAESTRO in the Context of Agentic AI What MAESTRO Stands For Each word in the acronym carries meaning. Multi-Agent Environment signals that the framework models entire ecosystems of interacting agents, not a single model behind an API. Security, Threat, Risk covers the core discipline: identifying attack surfaces, cataloging threats, and assessing likelihood and impact. Outcome is the part most frameworks skip. MAESTRO asks what an attack actually produces in the real world, because an autonomous agent with tool access turns a compromised prompt into a compromised action. The Origin of MAESTRO (Cloud Security Alliance) The Cloud Security Alliance published MAESTRO in February 2025. Its creator is Ken Huang, Co-Chair of the CSA AI Safety Working Groups and CEO of DistributedApps.ai. The CSA has since applied the framework publicly to real systems, including OpenAI’s Responses API and Google’s A2A protocol, which gives practitioners worked examples rather than just theory. The framework is openly published, and the CSA maintains an official companion tool, the MAESTRO Threat Analyzer, on GitHub. SOC 2, ISO 27001 and HIPAA done for you. Fixed fee, 100% audit pass rate. Audit-ready in 6 weeks. Not 6 months. Schedule Free Assessment Why Traditional Frameworks Fall Short for Agentic AI STRIDE, PASTA, LINDDUN, and OCTAVE all share a founding assumption: the system under analysis follows predictable logic with clearly defined boundaries. You draw the data flow diagram, mark the trust boundaries, and enumerate threats against components that behave deterministically. Agentic AI breaks every part of that assumption. Unique Security Challenges of Autonomous Agents Agents introduce three properties that legacy models cannot express. Non-determinism means the same input can produce different behavior, so you cannot enumerate execution paths in advance. Autonomy means the agent makes decisions and takes actions without a human approving each step, which collapses the usual assumption that a person sits between intent and execution. And in multi-agent systems there is often no stable trust boundary: agents delegate to other agents, consume tool outputs from external servers via protocols like the Model Context Protocol (MCP), and update their own memory and goals at runtime. The Gap Between Legacy Frameworks and Agent-Based Systems The practical consequence is coverage gaps. STRIDE has no category for goal manipulation, where an attacker gradually steers what an agent is trying to achieve. PASTA assumes attacker objectives and data flows are fixed, which fails for systems that learn and adapt during operation. LINDDUN addresses privacy but says nothing about agent collusion or memory poisoning. A threat model built purely on these frameworks will pass review and still miss the attacks that matter most in an agentic deployment. How MAESTRO Addresses Agentic-Specific Risks MAESTRO does not discard the older frameworks. It extends them with a layered reference architecture, an AI-specific threat catalog for each layer, and, critically, explicit analysis of how threats propagate between layers. That cross-layer lens is the framework’s real contribution, because most serious agentic incidents are chains: poisoned data influences a model, the model misleads an agent, and the agent takes an unauthorized action three layers away from where the attack started. The Seven Layers of the MAESTRO Framework MAESTRO decomposes any agentic system into seven layers, each with its own threat landscape. Layer 1: Foundation Models The core LLMs or other models the agents reason with. Threats here include adversarial examples, model extraction, backdoored weights, and jailbreaks that bypass safety training. If the model is a third-party API, supply chain risk lives at this layer too. Layer 2: Data Operations Everything the agent ingests, stores, and retrieves: training data, RAG pipelines, vector databases, and agent memory. Data poisoning and memory tampering are the signature threats at this layer, and they are especially dangerous because a poisoned memory persists across sessions and keeps shaping future decisions long after the initial attack. Layer 3: Agent Frameworks The orchestration software that turns a model into an agent: LangChain, CrewAI, AutoGen, custom planners, and tool-calling logic. Threats include prompt injection through tool outputs, insecure tool definitions, and manipulation of the planning loop itself. Layer 4: Deployment Infrastructure The servers, containers, and cloud services the agents run on. The CSA’s threat catalog here reads like traditional cloud security with an agentic twist: compromised container images carrying malicious agent code, Kubernetes orchestration attacks, denial of service against agent runtimes, and tampering with Infrastructure-as-Code templates that provision agent resources. Layer 5: Evaluation and Observability The systems that monitor, evaluate, and debug agent behavior. This layer is often forgotten, and attackers know it. The CSA specifically flags poisoning observability data: manipulating the telemetry fed to monitoring systems so that incidents stay hidden from security teams while malicious activity continues. Layer 6: Security and Compliance MAESTRO treats this as a vertical layer that cuts across all others: identity and access management, guardrails, policy enforcement, and compliance controls. Threats include permission escalation, guardrail bypass, and compromise of the security agents themselves in architectures where AI enforces policy on other AI. Layer 7: Agent Ecosystem The environment where agents interact with users, other agents, and marketplaces. This is where the genuinely novel threats live: agent impersonation, misleading agent capability cards, tool squatting, and collusion between agents to achieve outcomes no single agent was authorized to pursue. Insider Note: In real assessments, Layers 5 and 6 expose the maturity gap fastest. Most teams’ shipping agents can describe their model and their orchestration framework in detail, then
AXIPRO STUDY New Study: Europe is hiring AI builders faster than AI governance professionals Axipro analyzed 3,519 AI-related job postings across eight EU countries. For every professional hired to keep AI lawful, safe and accountable, nearly seven were hired to build more of it, and the gap is widest exactly where you’d least expect. Take EU AI ACT READINESS QUIZZ 16 AI Builders : 1 AI Governors Sweden — Europe’s widest AI governance gap 3,519 Job Postings Analyzed 8 EU Countries 2 Role Categories: Builders vs Governors July 2026 Date of Job Postings Analyzed The findings Finding 1: Sweden hires 16 AI builders for every 1 person to govern them Throughout our data-set we found the same pattern across all eight countries: the more a nation hires to build AI, the less it hires to govern it. France runs eleven builders to every governor. Even Ireland, the most balanced in Europe, looks responsible mainly because the US tech giants headquartered there import global-governance discipline under overlapping DORA and AI Act pressure. 3.5→16 builders hired per governor, Europe’s most balanced country to its least. Ireland 3.5 Germany 5.7 Spain 6.0 Italy 7.1 Netherlands 7.2 Belgium 7.9 France 11.4 Sweden 16:1 0 4 8 12 16 Builders hired per AI governor Source: Axipro, 2026 Sweden has one of the strongest engineering cultures in Europe. It also carries the widest governance gap we measured: sixteen AI builders hired for every person hired to govern them. France sits close behind at eleven to one. The most balanced country, Ireland at 3.5 to one, looks responsible for a reason that has little to do with virtue. The US tech giants headquartered in Dublin import global governance discipline, and they do it under the combined weight of the AI Act and DORA, the EU financial-sector resilience regime in force since January 2025. Engineering strength does nothing to close a governance gap, and it may widen it. A country that ships AI faster produces more systems that fall under the Act’s scope and, on this evidence, fewer people positioned to document, monitor, and defend them. Being good at building AI offers no protection against governing it badly. The countries most confident in their technical talent are running the largest deficit against the law. Explore AI governance hiring by country Click any country to see how many AI builders it hires for every governance professional, and where it ranks against the rest of Europe. Germany — 5.7 builders per governorDE France — 11.4 builders per governorFR Spain — 6.0 builders per governorES Italy — 7.1 builders per governorIT Netherlands — 7.2 builders per governorNL Belgium — 7.9 builders per governorBE Ireland — 3.5 builders per governorIE Sweden — 16 builders per governorSE 3.5 — balanced 16 — widest gap Source: Axipro, 2026 Sweden 16builders for every governance professional Rank 1 of 8 · 20 governance roles vs 319 builder roles posted Only 30% of the AI governance roles name the AI Act Share this Embed this map Copy & paste — links back to Axipro Copy embed code Branded, one paste, backlink included. × Share this country insight Share this AI governance gap X / Twitter LinkedIn Facebook WhatsApp Bluesky Email Copy link Choose a platform or copy the link. A view of the same country-level dataset behind the interactive map: governance roles, builder roles, builder-to-governance ratio, and the share of governance postings that name the EU AI Act. AI governance jobs Europe statistics by country: governance roles, builder roles, builder-to-governance ratio and AI Act mention percentage. Country Governance roles Builder roles Builder-to-governance ratio AI Act mention % Sweden 20 319 16.0:1 30.0% France 39 443 11.4:1 38.5% Belgium 38 299 7.9:1 39.5% Netherlands 61 439 7.2:1 31.1% Italy 40 284 7.1:1 45.0% Spain 64 384 6.0:1 28.1% Germany 88 501 5.7:1 27.3% Ireland 96 335 3.5:1 14.6% Source: Axipro analysis of AI builder, governance and compliance job postings across eight European countries. “AI Act mention %” is the share of governance postings that explicitly name the EU AI Act. Finding 2: The law nobody names. Most AI governance jobs still do not mention the EU AI Act Europe spent years drafting the AI Act. It cleared the European Parliament, survived the Digital Omnibus revisions, and now carries penalties that reach €35 million or 7% of global turnover for the most serious breaches, a ceiling that makes GDPR fines look modest. Yet fewer than three in ten of the governance roles created to handle it actually name the law in the job description. Among builder roles, the figure collapses to one in twenty-five. More than 7 in 10 Governance job descriptions do not mention the EU AI Act. This number rises to 9 in 10 for all AI job descriptions. Despite hiring for governance, risk, privacy, and compliance roles, most employers are not yet translating the EU AI Act into explicit job requirements. That disconnect should stop you. The people being hired to make Europe compliant are, for the most part, not being hired against the Act by name. They are titled around adjacent ideas: risk, ethics, model validation, data protection. Some of that work will map onto the Act’s requirements. Much of it will not, because a role written without the regulation in view rarely produces the conformity assessments, technical documentation, and human-oversight structures the Act specifically demands. Readiness is even thinner than the headcount suggests. Simply counting governance hires overstates how many people are actually working the law. What job descriptions actually name The EU AI Act is visible in governance roles — but still absent from most job ads. Across the laws and frameworks most relevant to AI governance hiring, the EU AI Act appears in fewer than three in ten governance postings, and only 4% of builder postings. Law or framework Governance roles naming it Builder roles naming it All roles naming it Governance mentions EU AI Act 28.5% 4.0% 7.6% 127 GDPR 26.9% 5.7% 9.6% 120 ISO 27001 11.4% 1.3% 2.8% 51
78% of organizations have no formal policies for creating or removing AI agent identities, according to a 2026 report from the Cloud Security Alliance and Oasis Security. The same research found that 92% are not confident that their legacy identity and access management tools can handle the risks agents introduce. Those two numbers describe the problem in full: enterprises are deploying autonomous software that reads email, queries databases, and triggers actions across production systems, and most of them cannot say who authorized it, what it can touch, or how they would prove any of that to an auditor. This is not a future problem. Agents are already operating inside regulated environments governed by the GDPR, HIPAA, SOX, and the EU AI Act. Every access decision an agent makes is a compliance event, whether or not anyone is logging it. This article covers what regulators actually expect, where traditional IAM falls short, and how to build an access framework for AI agents that survives an audit. Understanding the Compliance Landscape for AI Agents Key Regulations Impacting AI Agent Access No regulation says “AI agent” and then hands you a checklist. Instead, agents inherit obligations from every framework that governs the data and systems they touch. Under the GDPR, an agent processing personal data triggers the full set of principles in Article 5: lawfulness, purpose limitation, data minimization, and accountability. If an agent makes decisions that produce legal or similarly significant effects on individuals, Article 22 restrictions on automated decision-making apply as well. HIPAA requires covered entities to implement access controls, audit controls, and integrity protections for electronic protected health information under the Security Rule, and an agent with access to ePHI is subject to the same technical safeguards as a human workforce member. SOX demands that access to financial reporting systems be controlled, segregated, and reviewable, which becomes genuinely difficult when an autonomous agent can touch the general ledger. The EU AI Act adds an AI-specific layer, and its timeline is widely misunderstood. Following the Digital Omnibus agreement, obligations for standalone high-risk systems under Annex III were deferred to December 2, 2027. But the Article 50 transparency obligations still apply from August 2, 2026, meaning agents that interact with people in the EU must disclose their artificial nature on the original schedule. Treating the Omnibus as a blanket delay is one of the most common compliance mistakes being made right now. Important: The Digital Omnibus deferred the high-risk regime, not the whole Act. If an AI agent interacts with users in the EU, the August 2, 2026, transparency requirements were not moved, and the AI Office’s enforcement powers go live on the same date. Do not stand down 2026 workstreams based on headlines about the 2027 deferral. How AI Agents Create New Compliance Risks Agents break the assumptions most compliance programs are built on. A human user requests access, receives a role, and behaves within a predictable envelope. An agent reasons about its own goals, chains tool calls across systems, and can attempt actions its designers never anticipated. It operates at machine speed and machine volume, so a misconfigured permission produces thousands of non-compliant data touches before anyone notices. And because agents frequently run on shared service accounts or borrowed OAuth tokens, attribution collapses: the audit log says the CRM was queried, but not by whom, for what purpose, or under whose authority. The Gap Between Traditional IAM Compliance and Agentic AI Traditional IAM assumes identities are stable, access needs are predictable, and behavior maps to a job description. None of that holds for agents. A 2026 Cloud Security Alliance survey found that 68% of organizations cannot reliably distinguish AI agent activity from human activity in their logs. For a compliance function, that is disqualifying. If you cannot separate agent actions from human actions, you cannot certify access, demonstrate segregation of duties, or respond to a data subject access request with confidence. Core Compliance Requirements for AI Agent Access Auditability and Traceability of Agent Actions Every major framework converges on the same demand: show your work. For agents, a login timestamp is not enough. A defensible audit trail captures the full chain of custody for each action: which agent acted, which human or process delegated the authority, which tool or API was invoked, which data was accessed, and what the outcome was. Gartner’s 2026 Market Guide for what it calls “guardian agents” describes exactly this pattern of recording agent-to-tool-to-target chains for compliance reporting and incident response. Data Protection and Privacy Obligations Agents must operate inside the same data protection perimeter as everything else. That means Data Loss Prevention (DLP) controls apply to agent outputs, not just human uploads. It means an agent’s access to personal data needs a lawful basis, documented before deployment, not reverse-engineered after. And it means retention rules follow the data into whatever context window, vector store, or scratchpad the agent moves it into. Separation of Duties in Autonomous Systems Separation of duties exists so that no single actor can both commit and conceal an error or a fraud. A single agent granted permissions across procurement, approval, and payment reconstitutes exactly the toxic combination SOX controls were designed to prevent, except now it executes at machine speed. The control translates directly: no agent should hold permission sets that a human in the same process would be prohibited from combining, and multi-agent workflows need the same conflict analysis as human role assignments. Consent, Purpose Limitation, and Data Minimization Purpose limitation is the principle that agents most naturally violate. An agent given broad access “to be helpful” will use data collected for one purpose to accomplish another, because nothing in its architecture knows the difference. Compliance-ready agent access means scoping data access to the declared purpose of the task and enforcing that scope technically rather than hoping the system prompt holds. Insider Note: In practice, the purpose limitation failures we see are rarely dramatic. They look like a support agent enriching a ticket with data pulled from the sales
SOC 2 is not a certification, and no auditor will ever hand you a SOC 2 certificate. What you receive at the end of the audit is an attestation report: a detailed document, often 60 to 100 pages long, in which a licensed CPA firm expresses a professional opinion on your controls. That distinction sounds like pedantry until a prospect’s security team asks to see your “certificate” and you have nothing that looks like one. This article explains exactly what a SOC 2 report is, what it contains, how it differs from an ISO 27001 certificate, and how to talk about your SOC 2 status without misrepresenting it. Is SOC 2 a Certification or a Report? The Common Misconception About “SOC 2 Certification” Search volume tells the story: far more people look for “SOC 2 certification” than for “SOC 2 attestation,” and sales teams, procurement questionnaires, and even some auditors use the certification shorthand daily. The misconception is understandable. Every other major framework in the compliance stack, from ISO 27001 to PCI DSS, ends in something that looks like a pass. SOC 2 does not work that way, and treating it as if it does leads to awkward conversations during vendor due diligence. Why SOC 2 Is Technically an Attestation, Not a Certification A certification is a binary judgment issued by an accredited body: you meet the standard, or you do not. SOC 2 sits under the AICPA’s attestation standards, primarily SSAE 18 and its later amendments (SSAE 21 updated the relevant examination sections), specifically AT-C section 105 and AT-C section 205. Under those standards, an independent service auditor examines your controls and reports an opinion on them. Nobody “passes.” The auditor attests to what they found, in writing, with evidence. The output is a report, and the report is the entire deliverable. Understanding the SOC 2 Attestation Model What Is an Attestation Engagement? An attestation engagement is a formal examination in which a practitioner evaluates subject matter prepared by another party against defined criteria, then issues a written conclusion. In SOC 2, the subject matter is your system and its controls, the criteria are the AICPA’s Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy), and the party preparing the subject matter is you, the service organization. Security is the only mandatory category; the other four are scoped in based on your service commitments. The Role of the AICPA and Licensed CPA Firms The AICPA (American Institute of Certified Public Accountants) owns the SOC framework and the attestation standards behind it, but it does not perform audits and does not issue anything to your company. Only a licensed CPA firm can conduct a SOC 2 examination and sign the resulting opinion. That licensing requirement is the quality mechanism: the firm’s professional liability, independence rules, and peer review obligations stand behind the report. In practice, this means the assurance you get is only as strong as the auditor’s reputation and independence posture, which is why enterprise buyers often look at who signed the report almost as carefully as they look at what it says. How Attestation Differs from Certification and Accreditation The three terms describe different assurance models. Certification means an accredited certification body confirms conformity with a standard and issues a certificate, as happens with ISO 27001. Accreditation is one level up: it is the process by which national bodies, such as those coordinated through the International Accreditation Forum, authorize those certification bodies to certify in the first place. Attestation involves no certificate and no accreditation chain. A CPA firm examines evidence and expresses an opinion under professional standards. The credibility comes from the auditor’s license and independence, not from a badge. What You Actually Receive After a SOC 2 Audit The SOC 2 Attestation Report Explained The deliverable is a confidential, restricted-use document addressed to your management and intended for your customers, their auditors, and other informed parties. It is dense by design. A prospect’s risk team reads it to understand what your system does, which controls you operate, how the auditor tested them, and what the auditor found. It replaces a certificate with something far more useful: evidence. Key Components of the Final Report Independent service auditor’s opinion. The first section, usually two to three pages, states the auditor’s formal conclusion on whether your system description is fairly presented and whether your controls were suitably designed (and, for Type 2, operating effectively). This is the section report readers check first. Management’s assertion. A signed statement in which your leadership formally asserts that the system description is accurate and that controls meet the applicable criteria. SSAE 18 made this management assertion a mandatory element, which means responsibility for the description sits with you, not the auditor. System description. The longest narrative section was prepared by management against the AICPA’s SOC 2 description criteria. It covers the services provided, infrastructure, software, people, data, processes, subservice organizations, and complementary user entity controls. Trust Services Criteria and controls tested. A mapping of each in-scope criterion to the specific controls you operate. This is where scoping decisions become visible: a report covering Security only looks very different from one covering all five categories. Results of testing. For Type 2 reports, a control-by-control table showing the tests the auditor performed and the results, including any exceptions. Sophisticated readers spend most of their time here, because exceptions and the auditor’s response to them reveal more than the opinion page does. What a SOC 2 Report Is NOT (No Certificate, No Logo, No Pass/Fail Badge) There is no official SOC 2 certificate, no numbered credential, and no register of “certified” companies you can be listed in. The AICPA licenses a standard SOC logo that service organizations may display for a limited time after report issuance, but the logo confirms only that an examination took place. It says nothing about the opinion inside. Anyone selling you a “SOC 2 certificate” as a standalone artifact is selling something the framework does not produce. Important: If
The full SIG content library contains 1,936 questions. SIG Lite asks 128 of them. That difference is the entire point: most vendor relationships do not justify a multi-week questionnaire exchange, and SIG Lite exists so risk teams can run standardized due diligence on lower-risk vendors without burning analyst hours or vendor goodwill. What Is SIG Lite? SIG Lite is the streamlined version of the Standardized Information Gathering (SIG) questionnaire, the most widely used third-party risk assessment instrument in the industry. It condenses the full SIG question set into a short, high-level assessment of a vendor’s information security, privacy, and resilience controls. It is a self-assessment, not an audit: the vendor answers, the assessor evaluates, and the completed questionnaire becomes evidence of due diligence in a third-party risk management (TPRM) program. Purpose of the SIG Lite Questionnaire The purpose is speed with consistency. SIG Lite gives an outsourcing organization a broad understanding of a third party’s internal control environment using a standardized question set, so answers are comparable across an entire vendor portfolio. It works either as a complete assessment for low-risk vendors or as a preliminary screen that decides whether a deeper review is warranted. Because every vendor answers the same questions, risk teams can rank, tier, and triage instead of interpreting fifty differently formatted responses. Who Created and Maintains SIG Lite? SIG Lite is owned and maintained by Shared Assessments, a member-driven standards organization formed in 2005 when the Big Four accounting firms and six global banks set out to fix the inefficiency of every company writing its own vendor questionnaire. The SIG is developed through a formal governance process that draws on practitioner feedback and tracks evolving regulations and standards, which is a large part of why it has held its position as the de facto industry template. SOC 2, ISO 27001 and HIPAA done for you. Fixed fee, 100% audit pass rate. Audit-ready in 6 weeks. Not 6 months. Schedule Free Assessment What’s Included in the SIG Lite Questionnaire? Number of Questions and Structure The 2025 release of SIG Lite contains 128 questions. The exact count shifts slightly with each annual update (recent versions have ranged from roughly 126 to 133), so always confirm the version you are working with. Questions are predominantly yes/no with room for comments and references to supporting evidence, and each question maps back to the SIG content library and to external frameworks. SIG Lite ships as a single-worksheet questionnaire, which keeps completion and review manageable. Risk Domains Covered in SIG Lite SIG Lite draws its questions from the same 21 risk domains that structure the entire SIG, grouped into four control areas: Governance and Risk Management, Information Protection, IT Operations and Business Resilience, and Security Incident and Threat Management. In practice, that means high-level coverage of access control, information security policy, data privacy, cloud security, business continuity, incident response, supply chain risk, human resources security, compliance management, and ESG, among others. The breadth is the same as SIG Core; the depth per domain is what gets trimmed. Format and Delivery (Spreadsheet and Toolkit) Historically, the SIG has been delivered as an Excel workbook generated by the SIG Manager, the macro-driven engine inside the SIG Questionnaire Toolkit that lets assessors scope, generate, store, and compare questionnaires. That is changing. In March 2026, Shared Assessments launched SIG EV (Evolution), a browser-based platform that moves questionnaire creation, distribution, comparison, and grading to the cloud while preserving the same content and methodology. Vendors can still respond in Excel, and assessors can upload completed files, so the transition does not break existing workflows. Worth Knowing: SIG Questions & Permissions SIG questions cannot be edited without written permission from Shared Assessments, but assessors can add up to 100 custom questions to a scoped questionnaire. That is usually enough headroom to cover industry-specific requirements without abandoning the standard. When Should You Use SIG Lite? Ideal Vendor Risk Scenarios SIG Lite fits three situations well. First, vendors with no access to sensitive data or critical systems, where a full assessment would be disproportionate. Second, large vendor portfolios, where sending 600-plus questions to every supplier would stall onboarding across the board. Third, early-stage evaluation, where you need enough signal to decide whether a relationship is worth deeper diligence. Low-Risk vs. High-Risk Vendor Assessments The dividing line is data and criticality. A marketing tool that touches no customer records, a facilities contractor, or a niche SaaS product with read-only access to public data can all be assessed adequately with SIG Lite. A payroll processor, a cloud provider hosting production data, or any vendor storing regulated information under HIPAA, PCI DSS, GDPR, or GLBA should get SIG Core. Using Lite on a high-risk vendor is a documented gap waiting to be found in your next audit. Initial vs. In-Depth Risk Screening Many mature programs use SIG Lite as a gate rather than a destination. The Lite response feeds an initial risk score; vendors that trip defined thresholds (a missing incident response plan, no encryption at rest, no independent certification) graduate to SIG Core or a targeted domain-level assessment. This two-stage pattern keeps effort proportional to risk and gives vendors a lighter first touch. SIG Lite vs. SIG Core: Key Differences Both questionnaires come from the same content library and cover the same 21 risk domains. The differences are scope, depth, and effort. Question Count and Scope SIG Lite’s 128 questions sit at the top of the control hierarchy: does a policy exist, is a program in place, and is there independent validation? SIG Core’s 627 questions descend into how each control actually operates. Beyond both sits the full SIG Detail library of 1,936 questions, which assessors use to build custom scopes by regulation, domain, or control family. Depth of Assessment A SIG Lite answer tells you a vendor has an access control program. A SIG Core response tells you how privileged accounts are reviewed, how quickly access is revoked at termination, and how authentication is enforced across environments. If your obligation is
In 2018, a cyberattack on SingHealth exposed the records of 1.5 million patients, including the Prime Minister. The Personal Data Protection Commission (PDPC) handed down S$1 million in combined penalties, and that decision still sits on its public enforcement page today. The Personal Data Protection Act (PDPA) has sharper teeth than it did a few years ago. Since October 2022, the PDPC can impose financial penalties of up to 10% of an organisation’s annual turnover in Singapore, or S$1 million, whichever is higher. Breach notification is now mandatory. And a hard deadline is approaching: from 1 January 2027, using NRIC numbers for authentication becomes an enforcement target. A checklist is how you turn all of that into something you can actually execute against, rather than a legal document you skim once and forget. What Is the PDPA Compliance Checklist? A PDPA compliance checklist translates the law’s 11 data protection obligations into concrete, verifiable actions. The obligations themselves are principles: Consent, Purpose Limitation, Notification, Access and Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, Data Breach Notification, Accountability, and Data Portability (legislated in 2020 but not yet in force). A principle tells you what good looks like. A checklist tells you whether you have done it. The distinction matters because the PDPC does not accept good intentions as a defense. When it investigates, it looks for documented policies, a named Data Protection Officer (DPO), evidence of consent, and a breach plan that existed before the breach. The checklist is what produces that evidence trail. SOC 2, ISO 27001 and HIPAA done for you. Fixed fee, 100% audit pass rate. Audit-ready in 6 weeks. Not 6 months. Schedule Free Assessment Who Needs to Follow the PDPA Compliance Checklist in Singapore Every private sector organisation that collects, uses, or discloses personal data in Singapore falls under the PDPA. That covers sole proprietorships, partnerships, companies, and foreign entities with Singapore operations. Headcount is irrelevant. A five-person startup carries the same obligations as a multinational, and the PDPC has shown it will penalize small and mid-sized businesses, not only household names. Physical presence is not the trigger either. If your processing touches individuals in Singapore, the Act can reach you even without a local office. Public sector agencies sit under separate legislation, but the private sector rules administered by the PDPC, which operates under the Info-communications Media Development Authority (IMDA), apply broadly. One useful carve-out: business contact information used purely for business purposes is largely exempt from the consent rules. Worth Knowing: PDPA Roles Explained The PDPA distinguishes an organisation from a data intermediary, a party that processes data on another’s behalf. Intermediaries carry a narrower but real set of duties, mainly protection and retention. If you outsource payroll, hosting, or email marketing, you are the organisation and your vendor is the intermediary, and the contract between you needs to say so explicitly. PDPA Compliance Checklist: Step-by-Step Guide The 15 steps below move roughly in the order you should tackle them, from governance foundations through operational controls to ongoing assurance. Treat them as a sequence, not a menu. Step 1: Appoint a Data Protection Officer (DPO) The PDPA requires every organisation to designate at least one individual responsible for compliance, and to make that person’s business contact details available to the public. You do not have to hire a specialist. In smaller firms, an existing employee can hold the DPO role alongside other duties. What matters is that the role is named, resourced, and reachable, because the DPO is who the PDPC and affected individuals contact first. Publish the contact details on your website and inside your privacy notice. Step 2: Map and Inventory Personal Data You cannot protect data you cannot see. Build a data inventory that records what personal data you hold, where it lives, which systems and people can access it, why you collected it, and how long you keep it. This map is the single most useful artifact in your entire program. It feeds your privacy notice, your retention schedule, your breach assessments, and your vendor reviews. Most compliance failures trace back to a blind spot, a spreadsheet of customer records nobody remembered, or a legacy database still holding data long past its purpose. Step 3: Establish Lawful Basis and Obtain Valid Consent Under the Consent Obligation, you generally need an individual’s consent before you collect, use, or disclose their personal data, and that consent must be tied to a specific, notified purpose. The 2020 amendments added flexibility: deemed consent covers scenarios like contractual necessity, and the legitimate interests exception lets you process data where the benefit outweighs any adverse effect, provided you document the assessment. You cannot make consent to unrelated data uses a condition of providing a service. Important: Bundled consent is a common enforcement trigger. A single checkbox that forces a customer to agree to marketing in order to complete a purchase is not valid consent for the marketing. Separate the purposes, and let people say yes to one without being forced into the other. Step 4: Draft and Publish a Compliant Privacy Notice Your privacy notice is the public expression of how you handle personal data. It should state what you collect, the purposes you collect it for, who you share it with, how long you retain it, and how individuals can contact your DPO or exercise their access and correction rights. Write it in plain language. A notice dense enough to deter reading does not satisfy the spirit of the Notification Obligation, and regulators notice the difference. Step 5: Implement the Notification of Purpose Requirement The Notification Obligation and the Purpose Limitation Obligation work as a pair. You must inform individuals of the purpose before or at the point of collection, and you must then confine your use of the data to that purpose. Practically, that means a clear notice at every collection point: sign-up forms, website pop-ups, contact forms, event registrations. Selling a customer list you gathered for order fulfillment is precisely the kind of
ISO 42001 is the first international standard an organization can be certified against for how it builds, provides, and runs artificial intelligence. It was published in December 2023 by ISO and IEC, and it defines an AI Management System (AIMS) that an accredited auditor can actually inspect. That single fact reshaped the compliance conversation for anyone shipping AI products. A SOC 2 report tells a buyer your data handling is sound. It says nothing about whether your models are governed, your training data is documented, or your automated decisions can be explained. Enterprise procurement teams figured this out fast. AI-specific questionnaires now show up in deals that used to close on a SOC 2 report alone, and buyers increasingly want a recognized certification behind the answers. ISO 42001 is becoming that certification, and Vanta is the platform many AI companies reach for to get there without building a governance program from nothing. What Is ISO 42001 and Why It Matters for AI Companies ISO 42001 at a glance: the first AI management system standard ISO/IEC 42001:2023 specifies the requirements for establishing, maintaining, and continually improving an AIMS. It follows the same Harmonized Structure as ISO 27001 and ISO 9001, so the backbone is familiar: context, leadership, planning, support, operation, performance evaluation, and improvement. The difference sits in the annexes. Annex A defines roughly 38 AI-specific controls across nine areas, covering AI policy, internal roles, resources, impact assessments, lifecycle processes, data management, information for interested parties, use of AI systems, and third-party relationships. Annex B gives implementation guidance, and Annex C lists organizational objectives and risk sources. What makes the standard distinct is that it addresses problems that generic management systems never had to. Model outputs are probabilistic. Training data governance is messy. Automated decisions are hard to explain. Risk does not sit still; it shifts every time a model is retrained or a vendor pushes an update. Who in the AI ecosystem needs ISO 42001 The standard applies across the AI value chain. Providers that build and sell AI systems, developers that create models or components, and deployers that integrate AI into their own products or operations all fall within scope. A Series B startup shipping a generative feature, an enterprise embedding AI in hiring workflows, and a public agency using AI for citizen services can each build an AIMS against the same clauses. For AI-native companies, the pull is commercial before it is regulatory. Certification is turning into a procurement filter. When a large customer’s security review asks how you govern model risk, “we have SOC 2” is no longer a complete answer. How ISO 42001 fits alongside SOC 2, ISO 27001, and the EU AI Act These frameworks are not competitors. They stack. ISO 27001 secures your information. SOC 2 proves your controls to customers. The EU AI Act is binding law with penalties. NIST AI RMF is voluntary guidance. ISO 42001 is the connective tissue that puts an auditable management system around AI specifically. Insider Note: The reason ISO 42001 sells itself in enterprise deals is that it fills a gap SOC 2 was never designed to cover. SOC 2 examines security, availability, and confidentiality. It does not ask whether you ran an AI impact assessment, whether a human reviews high-stakes model outputs, or whether you track which third-party models touch customer data. Buyers now write those exact questions into vendor questionnaires, and a 42001 certificate answers most of them before the call even starts. Need help implementing ISO 42001 in Vanta? Axipro can guide you from setup to certification readiness. Schedule Free Assessment The Unique AI Compliance Challenges Vanta Solves Managing AI-specific risks across models, data, and vendors Traditional GRC tooling was built for static controls. AI risk is not static. A model that passed review at launch can drift, a new data source can introduce bias, and a fine-tune can reclassify your legal obligations overnight. Vanta’s value for AI companies is treating these as continuous, monitored controls rather than one-time checkboxes, spanning the models you build, the data that feeds them, and the vendors whose models you embed. Keeping pace with evolving global AI regulations The regulatory floor keeps moving. The EU AI Act phases in over several years, US agencies are issuing guidance, and standards bodies are revising their work. Tracking this by hand across eight jurisdictions is not realistic for a lean team. A compliance platform that maps a single control set to multiple frameworks turns that sprawl into something maintainable. Proving trust to enterprise buyers procuring AI products The end goal of most of this work is a shorter sales cycle. Enterprise buyers procuring AI want evidence, not assurances. A live, shareable view of your AI compliance posture answers the questionnaire before it becomes a bottleneck, which is exactly what a Trust Center is built to do. How Vanta Supports ISO 42001 Certification for AI Companies Automated evidence collection mapped to ISO 42001 controls The heaviest part of any certification is evidence. Vanta connects to your cloud, identity, and development stack and pulls control evidence automatically, then maps it to the relevant ISO 42001 clauses and Annex A controls. Instead of screenshotting configurations the week before an audit, you accumulate evidence continuously. That shifts the audit from a scramble into a review. Pre-built policy templates for AI governance ISO 42001 expects documented policies for AI use, roles, and risk management. Building these from a blank page is slow and error-prone. Pre-built AI governance policy templates give teams a defensible starting point they can adapt to their actual operations, which matters when an auditor asks not just whether a policy exists but whether it reflects what you really do. Continuous control monitoring for AI systems Certification is a snapshot. An AIMS is supposed to be alive. Continuous monitoring is where the platform earns its keep, flagging when a control drifts out of compliance so you can fix it before it becomes an audit finding or, worse, a real incident. Cross-mapping ISO 42001
Most companies configure Vanta backwards. They connect integrations first, watch tests turn green, and only then ask which framework they are actually being audited against. By the time the auditor asks for the observation window start date, half the account needs to be rebuilt. The order you set things up in Vanta matters almost as much as what you set up, and getting it wrong costs weeks you do not have before a first audit. This checklist walks through the sequence that actually holds up under audit: the decisions to make before you touch the platform, the sequence of configuration inside it, and the final readiness checks before you hand the account to an auditor. Why a Vanta Implementation Checklist Matters Before Your First Audit Vanta is compliance automation software, not a compliance program. It monitors, syncs, and flags. It does not decide your scope, pick your framework, or tell you when your observation window can safely begin. Those calls are yours, and if you make them after connecting integrations rather than before, you end up rescoping mid-implementation, which resets test history and pushes your audit timeline back by weeks. A first-time implementation typically runs six to twelve weeks from account creation to a fully passing test suite, depending on how much of the underlying control environment already existed. Companies that skip the pre-implementation planning stage and jump straight into connecting AWS and Okta tend to discover, three weeks in, that half their integrations are out of scope, their policies do not match their actual operations, and their observation window needs to restart. Ready for your first audit? Get audit-ready with expert Vanta implementation support. Schedule Pre-Implementation: Foundational Decisions to Make First Define Your Target Framework (e.g., SOC 2, ISO 27001, HIPAA) Every downstream Vanta setting, from which integrations you connect to which policies you publish, depends on the framework you are pursuing. SOC 2 Type II evaluates your controls against the AICPA’s five Trust Services Criteria, security, availability, processing integrity, confidentiality, and privacy, with security as the only mandatory category. ISO 27001 asks you to build a full Information Security Management System (ISMS) under a structured set of clauses, backed by a broader set of technical, physical, and organizational controls in Annex A. HIPAA and PCI DSS bring their own control sets tied to specific data types, protected health information and cardholder data, respectively. If your customers are asking for a specific report, let that drive the decision rather than defaulting to whichever framework has the most templates in Vanta’s library. A fintech company with enterprise banking customers may need SOC 2 first and PCI DSS second. A healthcare SaaS vendor almost always needs HIPAA regardless of what else it pursues. Mapping frameworks to actual customer and contractual requirements before configuration saves you from scoping controls you will never use. Important: Choosing multiple frameworks at once is common, but sequencing them wrong creates duplicate work. Configure your primary framework fully, get through a full observation cycle if pursuing Type II, and add secondary frameworks once your evidence collection habits are established. Vanta will map shared controls across frameworks automatically, but only once both are active in the account. Set Your Audit Timeline and Observation Window If you are pursuing SOC 2 Type I, there is no observation window. The audit evaluates whether your controls are designed correctly as of a single point in time, and you can move to audit as soon as your tests pass. SOC 2 Type II is different: the observation window, also called the audit window or monitoring period, is the span during which the auditor samples evidence to confirm your controls actually operated, not just that they existed on paper. For a first Type II audit, a three to six month window is standard. Mature organizations settling into an annual cadence typically move to a full twelve-month window once they have proven consistent operation. Do not start the observation window until you are confident your controls are actually running as designed. Auditors can sample any event from the first day of the window forward, and a control failure in week two of a six-month window is just as damaging to your report as one in week twenty. This is the single most common timeline mistake first-time customers make in Vanta: they start the clock the day they finish connecting integrations, before policies are published, before HR sync is confirmed, and before access reviews have actually happened once. Identify Internal Owners and Stakeholders Every control needs a named owner inside Vanta, not a department. “Engineering” is not a control owner. The engineering manager who reviews production access quarterly is. Before you start configuring, map out who owns identity and access management, who owns vendor risk, who owns HR onboarding and offboarding, and who owns policy publication and employee acknowledgment. If your organization is small enough that one person wears several of these hats, that is fine, but it needs to be explicit in the tool, because Vanta’s task assignments and reminder emails route based on these ownership fields. Choose Your Auditor Before You Configure Vanta Auditor selection affects configuration choices that are expensive to reverse. Different CPA firms and ISO certification bodies have different tolerances for exceptions, different expectations around evidence formatting, and different preferences on how granular your control mapping should be. Get your auditor engaged, or at minimum shortlisted, before you finalize your framework scope and observation window in Vanta. Some firms will do a pre-audit readiness call that surfaces scoping issues Vanta’s automated checks will not catch, like whether a particular subprocessor needs to be in scope. Step 1: Configure Company Settings in Vanta Add Company Details and Business Information Start with the basics: legal entity name, headquarters address, description of the service you provide, and the systems that process customer data. This becomes the backbone of your system description, the narrative document that accompanies your SOC 2 report and explains what your company does and how the in-scope systems support