Compliance notes

Writing on our work

Observations from current engagements, opinion on industry developments, and the occasional longer essay.

2026-04-10 · Cormac Walsh · SOC 2

What SOC 2 auditors are actually looking for in awareness evidence — 2026 update

The annual update on what SOC 2 auditors prioritise in awareness-evidence reviews, based on the audits our customers ran in 2025.

2026-03-04 · Liam O'Connor · Audit evidence

Many awareness platforms produce "certificates" that have no audit standing. Here's what produces evidence and what doesn't.

2026-02-08 · Cormac Walsh · DORA

Our reading of DORA's training and awareness expectations, based on the first cohort of inspections our customers have undergone.

2026-01-12 · Aoife Murphy · ISO 27001

The 2022 revision reorganised the Annex A controls; awareness-related controls sit in different places under the new structure.

2025-12-05 · Sinéad Ryan · PCI DSS

PCI DSS v4.0 expanded the security awareness requirement; what the changes mean for customers in payments.