Guides for auditors

Practical, outside-in evidence for ISO 27001, SOC 2 and third-party risk: what each check proves, what good looks like, and what to ask.

ISO 27001:2022 evidence you can collect from outside the network Which Annex A controls leave a trace on the internet, and how to evidence them in ten minutes. 8 min read · ISO 27001 auditors and ISMS owners

Auditing email authentication: SPF, DKIM and DMARC explained for auditors What each record proves, the five findings that matter, and the questions to ask. 7 min read · Auditors, GRC teams, IT managers

TLS and certificate evidence for ISO 27001 A.8.24 and SOC 2 CC6.7 Protocol versions, certificate management and HSTS: what to check and what to ask for. 6 min read · Auditors and security engineers

The ten-minute external security review: a checklist for auditors A repeatable outside-in review of any organisation’s domain, with what to record. 6 min read · Auditors and third-party risk teams

DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy The domain itself is an asset. How to check it is owned, protected and resilient. 6 min read · Auditors and IT managers

Run the checks these guides describe

One domain, over 30 checks, mapped to ISO 27001, SOC 2 and NIST CSF.

Cyber security compliance check