SOC 2 and ISO 27001, decided rather than bought.
Work out what applies to you, what would have to exist for somebody else to believe it runs, and what your own clean sample did not prove. No readiness score, because there is no honest one.
When would you have to start?
A buyer wants a report covering twelve months. You have not started.
work had to start by 26 June 2026
The period, the fieldwork and the work before the period add up past their date. Drag until it does not.
counted from 2 October 2026 · nothing here reads your clock
What did you walk in saying?
Eight sentences. One decision procedure underneath all of them.
A customer just sent us a two-hundred-question form.
Somebody has asked you for a document. Find out what they are actually asking for, when you would have had to start, and what it costs you every year after.
The Ask · 10 lessons
What exactly are we putting inside the boundary?
The most consequential decision in the whole exercise, and the one most often made by pasting somebody else's sentence.
The Boundary · 12 lessons
We have a risk register and nobody reads it.
Every risk register you have seen multiplies two ordinals into a number that means nothing. Build one that does not, and find that it is more useful.
Risk, without the score · 12 lessons
We wrote the policy. Is that the control?
A document saying you will do something, and a record of you having done it, are not the same object. Most first audits fail on exactly that.
What a control is · 12 lessons
What do we actually hand them?
What would you hand someone who asked to see it running? Answer that for every control and the audit is mostly over.
Evidence · 12 lessons
They tested twenty-five and found nothing.
A period, a sample, and a conclusion drawn from both. This is where the arithmetic is public, routinely wrong, and never mentioned.
The Window · 12 lessons
Fieldwork starts in three weeks.
What the person across the table is actually testing, which is narrower and more specific than the anxiety suggests.
The Audit · 13 lessons
We passed last year. Nobody has touched it since.
The first report is a project with a deadline and an owner. The year after it is nobody's project, which is where this gets lost.
The Second Year · 12 lessons
It tells you what does not line up. It will never tell you that you are ready.
Nobody can simulate an auditor honestly — sufficiency is a judgement that moves with the auditor, the boundary and the year. What can be decided with no judgement at all is whether two things you wrote contradict each other: a control you marked as running with nothing attached that could show it ran, a risk you accepted with nobody named as having accepted it, evidence whose period does not touch the period you are claiming.
That is where almost every real finding comes from, and you cannot bluff a graph into consistency.
Four things this refuses to do
- No readiness percentage. Not hidden, not behind a caveat — there is no aggregate number in the whole subject. The only counter goes up as you fill the workspace in honestly, so it cannot be screenshotted as a claim.
- No likelihood times impact. Two ordinals multiplied give a unitless number on an uneven scale, where four by three and six by two are not the same risk and want different treatments. Bands are kept; the product is never computed.
- No clause text. The standards are licensed. This cites identifiers, describes requirements in its own words, and tells you to buy the standard — and the control register is capped by a build check so it cannot quietly become a copy of one.
- No claim that this is your system of record. A filled-in register is a list of your known weaknesses. Export and delete are first-class, and your auditor will want the real one somewhere they can see it.
8 tracks · 95 lessons · ~20h · free, forever