Compliance in a Box blogPractical notes on running a SOC 2 compliance program in Confluence.https://compliance.auralitesolutions.com/blog/2026-10-01T00:00:00ZAuralite Solutionshttps://compliance.auralitesolutions.com/assets/favicon-32.pngConfluence policy management: beyond a wiki pagehttps://compliance.auralitesolutions.com/blog/confluence-policy-management.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat policy management needs beyond a wiki page, how to set up a policy area in Confluence by hand, and where manual document control breaks down.Confluence read confirmation: proving people read a pagehttps://compliance.auralitesolutions.com/blog/confluence-read-confirmation.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhy page views, likes and comments don't prove anyone read a Confluence page, where the usual workarounds break, and what a read confirmation should record.SOC 2 risk assessment: a step-by-step guide with templatehttps://compliance.auralitesolutions.com/blog/soc2-risk-assessment.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat the SOC 2 CC3 criteria expect from a risk assessment, a step-by-step annual process for small teams, a risk register template and the mistakes to avoid.Vendor risk management for SOC 2: a practical guidehttps://compliance.auralitesolutions.com/blog/vendor-risk-management.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZHow to manage vendor risk for SOC 2: a vendor inventory, risk tiers, reading vendor SOC 2 reports, subservice organizations, the annual review and the evidence to keep.SOC 2 controls list: common controls for small SaaS teamshttps://compliance.auralitesolutions.com/blog/soc2-controls-list.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZSOC 2 has no mandated controls list. How criteria, controls and evidence differ, common controls for a small SaaS company by area, and how a controls matrix ties them together.SOC 2 trust services criteria explained, and which to choosehttps://compliance.auralitesolutions.com/blog/trust-services-criteria.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZA plain-English reference to the SOC 2 trust services criteria: the five categories, the Common Criteria CC1 to CC9, the optional series, and how to choose your scope.An information security policy template, section by sectionhttps://compliance.auralitesolutions.com/blog/information-security-policy.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat to write in each section of your information security policy, with example wording to adapt, what to leave to topic policies, and how to approve, review and roll it out.Access control policy for SOC 2: what it should sayhttps://compliance.auralitesolutions.com/blog/access-control-policy.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat a SOC 2 access control policy should cover: least privilege, joiners and leavers, MFA and passwords, admin and shared accounts, reviews, exceptions and evidence.Security awareness training for SOC 2: what auditors expecthttps://compliance.auralitesolutions.com/blog/security-awareness-training.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhy SOC 2 auditors look for security awareness training, what a small company's program should cover, how often to train, and how to keep material, rosters and follow-ups as evidence.Vulnerability management for SOC 2: the monthly scan reviewhttps://compliance.auralitesolutions.com/blog/vulnerability-management.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZHow to run vulnerability management for SOC 2: what to scan, a monthly scan review, remediation SLAs by severity, risk acceptance, and the evidence auditors expect.SOC 2 penetration test: is it required, and how to run onehttps://compliance.auralitesolutions.com/blog/soc2-penetration-test.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhether SOC 2 requires a penetration test, how it differs from a vulnerability scan, and how to scope, time, run and evidence an annual pen test for your audit.How to run a backup restore test and a DR test for SOC 2https://compliance.auralitesolutions.com/blog/backup-restore-dr-testing.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZProve your backups work: RTO and RPO in plain terms, a step-by-step quarterly restore test with a record template, an annual DR test, and the evidence SOC 2 auditors look for.How to answer a security questionnaire before your SOC 2https://compliance.auralitesolutions.com/blog/security-questionnaires.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat security questionnaires are, the common formats, how to answer honestly before you have a SOC 2 report, and how to build an answer library that doubles as a readiness plan.SOC 2 readiness checklist for small teamshttps://compliance.auralitesolutions.com/blog/soc2-audit-readiness-checklist.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZA seven-phase SOC 2 readiness checklist for small teams, from scoping and owners to policies, controls, evidence, picking an auditor and the weeks before fieldwork.Which SOC 2 policies do you need? A practical listhttps://compliance.auralitesolutions.com/blog/soc2-policies-list.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZThe SOC 2 policies an audit expects, grouped by topic, with what each covers and the criteria it supports, plus how to own, approve, review and roll them out.SOC 2 Type 1 vs Type 2: which report should you get first?https://compliance.auralitesolutions.com/blog/soc2-type-1-vs-type-2.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat SOC 2 Type 1 and Type 2 reports test, how to choose which to get first, and what the observation period demands: every control running and leaving evidence, every period.How to run a SOC 2 compliance program in Confluencehttps://compliance.auralitesolutions.com/blog/soc2-in-confluence.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhy Confluence suits a SOC 2 program, how to lay out a compliance space, and the five gaps plain Confluence leaves in an audit (and how to close them).The SOC 2 compliance calendar: recurring controls by cadencehttps://compliance.auralitesolutions.com/blog/soc2-compliance-calendar.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZSOC 2 controls recur. A calendar of the recurring activities by cadence, the evidence each should produce, and how to set owners, due dates and notice so audits are not a scramble.SOC 2 evidence collection: building an audit-ready libraryhttps://compliance.auralitesolutions.com/blog/soc2-evidence-collection.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat counts as SOC 2 evidence, how auditors sample it, and how to build an evidence library filed by control and period as the work happens.Policy version control and approvals auditors accepthttps://compliance.auralitesolutions.com/blog/policy-approval-version-control.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZAn approval only covers the exact text that was approved. What auditors check in policy version control, and an approval workflow that keeps approvals and published policies in step.Policy acknowledgement tracking for SOC 2: a practical guidehttps://compliance.auralitesolutions.com/blog/policy-acknowledgement-tracking.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZWhat auditors expect from employee policy acknowledgements, when to ask people again after a policy changes, and how to track completion without chasing people by hand.How to run a user access review for SOC 2https://compliance.auralitesolutions.com/blog/user-access-review.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZA step-by-step guide to the SOC 2 user access review: scoping systems, choosing reviewers, what to check, fixing what you find and the evidence to keep.How to run an incident response tabletop exercisehttps://compliance.auralitesolutions.com/blog/incident-response-tabletop-exercise.html2026-10-01T00:00:00Z2026-10-01T00:00:00ZTest your incident response plan in about 90 minutes: who to invite, a simple agenda, five ready-to-use scenarios with injects, and what to record for your SOC 2 auditor.