The Audit Window

Safeguard
  • 0.0 (0)
  • Technology
  • Weekly

A weekly compliance podcast for security, GRC and startup teams: SOC 2 Type 1 and Type 2, ISO 27001, HIPAA, vendor risk management (TPRM), audit evidence, compliance automation, security questionnaires and audit readiness. Each episode covers recent compliance news, one control walked through step by step, and a checklist for your audit window. Topics: observation window, auditor, risk assessment, trust center. Learn more at safeguard.sh.

Episodes

  1. 1d ago

    The Audit Window, Ep 3: GDPR for a small SaaS: the data subject request and the evidence behind it

    On a Friday at ten to five, an email arrives with two lines: send me everything you hold about me, and delete my account. The one month clock started when it landed. Mira and Cal follow that request through a small software company and sit in the reviewer's chair: the received date, who checked identity, which systems were searched, who reviewed the package, and the day the answer went out. They explain the one month deadline in Article 12 and the extension rule, how to confirm who is asking without collecting a passport scan, why logs with IP addresses count, what to do about backups when someone asks for erasure, how to correct data and tell the recipients, what data portability covers, and what a record of processing is for. They also cover the controller and processor question for a company that sells to businesses, and where Safeguard fits on the software evidence side without making anyone compliant. Before that, three stories: the noyb complaints against Scale AI filed on 27 October (allegations, with the company's response), the French regulator's fine against Extia over erasure requests, and the draft EDPB guidelines on fines that are open for comment until 13 November. Theo asks whether your deletion button really deletes, and the episode ends with a checklist for before your window opens. If you run a small software company and need to answer GDPR data subject requests, this episode covers the one month deadline under Article 12, identity checks, the right of access, the right to erasure and backups, rectification, data portability, the record of processing under Article 30, controller and processor roles, and the audit evidence a regulator or customer reviewer asks to see.

    The Audit Window, Ep 3: GDPR for a small SaaS: the data subject request and the evidence behind it

  2. 5d ago

    The Audit Window, Ep 2: HIPAA for a SaaS vendor: the BAA and the evidence behind it

    A hospital group says yes to your demo, then sends a contract with three letters in the title. B A A. There is no HIPAA certificate you can hold up, so what will they ask you to show? Mira and Cal sit in the reviewer's chair for a small software vendor's first request list from a hospital's privacy lead: a dated risk analysis, the sub-processor agreements, log review proof, training records and a breach notification path. They explain who counts as a business associate, what the rule says a B A A must contain, what required and addressable really mean, why the risk analysis comes first, and where the proposed Security Rule rewrite stands (a proposal, with a federal target of July 2027). Before that, two late October stories about patient data in someone else's system: the Quest Diagnostics filing about unauthorized access to a system clinics use for lab orders, and a Denver Health Medical Plan vendor incident involving an access key on a public website. Theo asks where a patient's name ends up in your company that is not the database. The episode ends with a checklist for before your window opens. Topics: HIPAA, business associate agreement (BAA), Security Rule, risk analysis, required and addressable, breach notification, vendor risk, SaaS compliance, Quest Diagnostics, Denver Health Medical Plan. Chapters00:00 Cold open00:46 Intro01:14 News: two late October stories on vendors and patient data05:14 Audit story: a hospital's request list, from the reviewer's chair08:19 Deep dive: business associates, the BAA and the Security Rule14:30 Practitioner corner15:41 Before your window opens17:15 Outro SourcesHIPAA: what it is and who has to comply: https://safeguard.sh/resources/blog/hipaa-what-it-is-and-who-needs-to-comply?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02HIPAA audit findings: why risk analysis tops the list: https://safeguard.sh/resources/blog/hipaa-audit-findings-risk-analysis-first?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02HIPAA compliance checklist for SaaS companies: https://safeguard.sh/resources/blog/hipaa-compliance-checklist-for-saas?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02HIPAA glossary: the terms engineers and buyers mix up: https://safeguard.sh/resources/blog/hipaa-glossary-plain-language-terms?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02How do you answer HIPAA questions on a customer security que: https://safeguard.sh/resources/blog/answering-customer-security-questionnaires-hipaa-questions?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02What should a startup do in its first 90 days of HIPAA?: https://safeguard.sh/resources/blog/hipaa-first-90-days-for-a-startup?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02HIPAA Security Rule: how to automate evidence collection: https://safeguard.sh/resources/blog/hipaa-security-rule-automating-evidence-collection?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02How do software supply chain controls map to HIPAA?: https://safeguard.sh/resources/blog/hipaa-software-supply-chain-controls-mapped?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02HIPAA Security Rule in Safeguard: risk analysis, safeguards : https://safeguard.sh/resources/blog/hipaa-security-rule-in-safeguard-risk-analysis-technical-safeguards-and-evidence?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02

    The Audit Window, Ep 2: HIPAA for a SaaS vendor: the BAA and the evidence behind it

  3. 5d ago

    The Audit Window, Ep 1: ISO 27001 when you already have SOC 2

    A buyer asks for an ISO 27001 certificate when you already hold a SOC 2 report. How much of the work do you get to keep? Mira and Cal sit in the auditor's chair for a first ISO audit, from stage 1 documentation review to stage 2 testing and the surveillance visits that follow. They explain what the Statement of Applicability is, how Annex A (2022) is organised into 93 controls in four themes, why the management system around the controls is the part a SOC 2 never asks you to build, and which evidence (change and vulnerability management, access reviews, scan results) carries over. Before that, two October stories on paper trails: the DHS order on DeepSeek products in the Federal Register and the EDPB's anonymisation consultation. Theo takes a question to settle before you write a word of the ISMS: is your ISO scope the same as your SOC 2 system boundary? The episode ends with a checklist for before your window opens. Topics: ISO 27001, SOC 2, Statement of Applicability, Annex A (2022), management system, stage 1 and stage 2 audit, surveillance audit, scope, DHS Order #2026-01, EDPB anonymisation. Chapters00:00 Cold open00:34 Intro00:54 News: the DHS supplier order and the EDPB anonymisation consultation03:23 Audit story: a first ISO 27001 audit, stage 1 to stage 205:52 Deep dive: the Statement of Applicability, Annex A and what carries over from SOC 209:43 Practitioner corner10:39 Before your window opens11:40 Outro SourcesWhat is ISO 27001?: https://safeguard.sh/resources/blog/what-is-iso-27001?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01ISO 27001:2022 Annex A controls guide: https://safeguard.sh/resources/blog/iso-27001-annex-a-controls-guide?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01ISO 27001 certification: complete guide and requirements: https://safeguard.sh/resources/blog/iso-27001-certification-complete-guide-and-requirements?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01ISO 27001 compliance for software development teams: https://safeguard.sh/resources/blog/iso-27001-compliance-for-software-development-teams?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01ISO 27001 risk assessment: how to conduct one: https://safeguard.sh/resources/blog/iso-27001-risk-assessment-how-to-conduct-one?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01ISO 27001 monitoring between surveillance audits: https://safeguard.sh/resources/blog/iso-27001-monitoring-between-surveillance-audits?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01ISO 27001 vs SOC 2: which framework is right for you: https://safeguard.sh/resources/blog/iso-27001-vs-soc-2-which-framework-is-right-for-you?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01Your first SOC 2 audit should not require your first complia: https://safeguard.sh/resources/blog/scale-up-soc2-iso-compliance-without-a-team?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01SOC 2 Type II vs ISO 27001: what each certification actually: https://safeguard.sh/resources/blog/soc-2-type-ii-vs-iso-27001-what-each-certification-actually-covers?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01DHS Exclusion and Removal Order #2026-01, Federal Register n: https://www.federalregister.gov/d/2026-21447?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01

    The Audit Window, Ep 1: ISO 27001 when you already have SOC 2

  4. Season 1 Trailer

    The Audit Window: trailer

    Trailer for The Audit Window, a weekly compliance podcast for security, GRC and startup teams: SOC 2 Type 1 and Type 2, ISO 27001, HIPAA, vendor risk management (TPRM), audit evidence, compliance automation, security questionnaires and audit readiness. Mira and Cal explain what your auditor will ask for and what you can show them. New episodes every Tuesday. Learn more at safeguard.sh: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=trailer Topics: SOC 2, ISO 27001, HIPAA, TPRM, vendor risk, audit readiness, auditor, observation window, compliance automation.

    The Audit Window: trailer
  • 1 Trailer
    3 Episodes

Trailer

About

A weekly compliance podcast for security, GRC and startup teams: SOC 2 Type 1 and Type 2, ISO 27001, HIPAA, vendor risk management (TPRM), audit evidence, compliance automation, security questionnaires and audit readiness. Each episode covers recent compliance news, one control walked through step by step, and a checklist for your audit window. Topics: observation window, auditor, risk assessment, trust center. Learn more at safeguard.sh.

Information

  • Creator
    Safeguard
  • Years Active
    2026
  • Episodes
    4
  • Rating
    Clean
  • Copyright
    © Safeguard
  • Show Website
    The Audit Window