The Cyber-Attest Practice
Running a modern cyber-attest practice — SOC 2, ISO 27001, ISO 42001, PCI DSS, HITRUST, FedRAMP, and DORA — in one console. Cross-framework control drift, IPE completeness at scale, evidence integrity, independence-by-design, and the engagement-margin math that decides which of your services survive AI pricing pressure.
- 2of 10
Detecting Year-Over-Year Control Drift Across the SOC 2 Type II Cycle: A Practitioner's Method
Control drift is the category of finding between 'operating effectively' and 'failed' — a directional change over time in population, frequency, disposition, or ownership. Most SOC 2 II examinations miss it because each cycle is tested in isolation. The four patterns worth detecting, the detection procedure that adds 2-4 hours at kickoff, and how to disclose drift responsibly in the report.
Read - 3of 10
IPE Completeness and Accuracy at Scale: Testing Client-Produced Reports Across 40+ Concurrent SOC 2 Engagements
IPE (Information Produced by the Entity) is the specific artifact type that produces more SOC 2 peer review findings than any other. Per-engagement heroics work at low volume; at 40+ concurrent engagements they eat the practice. The extraction-lineage approach that turns IPE testing from a scavenger hunt into a repeatable primitive — and what a defensible IPE workpaper actually contains.
Read - 4of 10
Independence-by-Design: Why 'Read-Only' Should Be an Architecture, Not a Policy
Policy independence is a peer-review vulnerability. Architectural independence — no write paths into the auditee's compliance state, one-way evidence flow, cryptographic integrity guarantees — resolves the appearance question a bundled auditor-and-platform vendor cannot. The five-question buyer's checklist, the three shapes of platform, and what peer reviewers actually look for.
Read - 5of 10
CaseWare, Suralink, Fieldguide, Thoropass: How the Cyber-Attest Software Stack Actually Compares in 2026
Five categories of cyber-attest platform, each with a distinct buyer profile. The category-by-category comparison — legacy workpaper (CaseWare, TeamMate+), PBC specialist (Suralink), AI-native workflow (Fieldguide), bundled auditor+platform (Thoropass, A-LIGN A-SCEND), and independent audit-firm substrate (vCISO Lite for Auditors) — plus the flat requirement-by-requirement table.
Read - 6of 10
Hash-Chained, Timestamp-Anchored Workpapers: The Evidence Chain-of-Custody Standard the AICPA Hasn't Named Yet
DMS-plus-log workpaper integrity is trivially forgeable in the modern threat model. Cryptographic evidence integrity — SHA-256 hash chains anchored to RFC 3161 timestamp authorities — is the mature, standards-based mechanism that resolves log-forgery, insider-elevation, and platform-migration failure modes. The five questions to ask any audit-tooling vendor.
Read - 7of 10
From 3PAO to C3PAO to CCSFP to QSA: One Console for Firms That Hold Multiple Assessment Accreditations
The mid-tier assessor firm segment (Coalfire, Schellman, 38North, A-LIGN, MegaplanIT) runs 4-6 accreditations concurrently on the same practitioners. Each accreditation carries its own regulatory context, competency requirements, reporting templates, and quality oversight. The operational efficiency delta between framework-siloed tooling and cross-framework substrate is 200-400 hours per enterprise client per year.
Read - 8of 10
The Cyber-Attest P&L: Realization, Utilization, and Engagement Margin When You Automate Evidence Review
Realization, utilization, engagement margin — the three metrics move differently in cyber-attest than in financial audit, and the levers are different too. The 2026 pressure pattern that shows up in engagement margin first, before realization or utilization compress. The one-page monthly dashboard for the cyber-attest practice partner.
Read - 9of 10
AI-Assisted Audit Sampling: What Passes Peer Review, What Doesn't
AI in audit sampling is being actively adopted; the peer-review implications are being worked out. The Big 4 pattern (Helix, Clara, GL.ai, Argus) — AI does the mechanical work, the practitioner does the judgment. The specific AI capabilities that pass peer review vs the ones that fail, and the workpaper documentation requirements when AI is in the workflow.
Read - 10of 10
DORA for Audit Firms: Where the Cyber-Attest Practice Enters
DORA creates a new set of audit-adjacent revenue lines for cyber-attest practices with EU financial-entity clients — Register-of-Information audit, Article 30 contract review, incident-classification testing, resilience-testing-programme audit. TLPT is the higher-revenue, higher-capability opportunity. The build-versus-partner-versus-acquire decision on offensive-security capability, the DORA-vs-AICPA independence contrast, and where DORA fits in a multi-accreditation practice.
Read
Ready to put this into practice?
See how vCISO Lite operationalizes the methodology behind this series.