Blog
Practical guidance on ISO 27001, SOC 2, ISO 42001, GDPR and penetration testing for scaling software companies.
The SOC 2 Compliance Checklist That Reflects How Audits Actually Work
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. There is no official SOC 2 compliance checklist. The AICPA publishes Trust Services Criteria, your organisation designs controls that meet them, and a licensed CPA firm examines those…
SOC 2 Requirements, Explained: Trust Services Criteria, Controls and Evidence
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. SOC 2 does not have a fixed requirements list. It has criteria: the AICPA Trust Services Criteria, defined in TSP Section 100 (2017, with revised points of focus…
How Much Does SOC 2 Cost? Auditor Fees, Readiness and the Real Total
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 06-08-2026”. The real cost of SOC 2 is three separate lines, and the auditor quote is only one of them. You pay for readiness work to design and implement…
SOC 2 in the UK and Ireland: Who Does the Readiness, Who Does the Audit
Last reviewed 8 August 2026 by Tom McNamara. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 07-08-2026”. If you run a software company in the UK or Ireland and a US enterprise buyer has just asked for your SOC 2 report, here is the short…
ISO 42001 Internal Auditors: Who Can Audit Your AI Management System?
Last reviewed 7 August 2026 by Mahrukh Fatima. This page is reviewed quarterly; the next review is due November 2026. Market facts are date-stamped “as of 07-08-2026”. The short answer: anyone competent and independent can perform your ISO 42001 internal audit, your own trained staff, or an external party acting on your behalf. ISO/IEC 42001’s…
How Much Does ISO 42001 Certification Cost? What Is Known So Far
By Mahrukh Fatima, AI Governance Manager at Atoro. Certified Lead Auditor, ISO 42001. No one publishes a fixed ISO 42001 certification cost, because the standard is under three years old (published December 2023) and the accredited certification market around it is younger still. No certification body publishes a fixed rate card; Schellman, the first accredited…
How Many Companies Are ISO 42001 Certified?
Public announcements from certification bodies and newly certified companies suggest that only around 350 organisations worldwide held ISO 42001 certificates by spring 2026. The standard was published in December 2023, so the certified population is still small, growing fast, and heavily weighted towards technology companies. Being certified today still puts an organisation in the earliest…
ISO 27001 for Startups Without a Security Team
A startup can certify to ISO 27001 without a dedicated security team. The standard is risk-based and scales to your size, so a 20-person company certifies a narrow scope, assigns existing people to the required roles, and runs a focused set of controls. A consultancy and a compliance platform cover the work headcount would otherwise…
How to Prepare for Your First SOC 2 Audit
Preparing for your first SOC 2 audit means scoping the report, choosing which Trust Services Criteria apply, running a readiness assessment, then collecting evidence that your controls work in practice. SOC 2 is an AICPA attestation performed by a licensed CPA firm, not a certification. Most of the effort is preparation, not the audit. How…
AI Governance for CTOs: What to Build Before You’re Asked
AI governance is the operating system you put around the AI you build or use: a record of where AI is deployed, an assessment of the risk and impact each system carries, a named human accountable for decisions, and monitoring that catches problems once a model is live. It turns ad-hoc AI use into something…