SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
The change-risk desk · Tuesday, September 22, 2026
RSS Standing risk monitors
All free tools →The three references this desk keeps open during a change window. Each one is free, runs in your browser, and needs no account.
- CISA KEVKnown Exploited Vulnerabilities catalog
Sortable view of the CISA KEV catalog, with the remediation deadline attached to each entry.
- MSRCNext Patch Tuesday
Rolling 12-month calendar available in the free tool.
- AWS / Azure / GCP / Cloudflare / GitHubCloud provider status heatmap
Combined status board across the five providers change teams care about.
-
Print Server Emergency Change: When a Utility App Turns Critical
A PaperCut NG/MF KEV entry put a 'boring' print server on a 14-day clock. Here is the emergency-change pattern for utility apps nobody tiered as critical.
-
BOD 26-04: Pre-Wire Your Emergency Change Before the Clock
CISA's BOD 26-04 sets a 16-row deadline table. Here is how a CAB pre-authorizes the ECAB so a 3-day KEV clock never catches you improvising.
-
The Patch You Could Calendar: SharePoint's RCE Chain
Microsoft split a SharePoint RCE chain across two Patch Tuesdays. Here is how a CAB stages a planned emergency change for a fix you know is coming.
-
SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
-
PCI DSS 6.4.3: Payment-Page Scripts as a Change-Control Problem
PCI DSS 6.4.3 and 11.6.1 have been mandatory since March 2025. Here is how to wire payment-page script authorization into your change process.
-
The Compensating Controls Register Auditors Accept
You deferred a control and promised a compensating one. Here is the register entry that PCI, SOC 2, and NIST assessors sign off on instead of flagging.
-
This Week in Change Risk — Week of Sep 14, 2026
This week's change-risk digest: 4 new CISA KEV entries with two CVSS-10 Cisco flaws, a GitHub P1 outage, PagerDuty's SRE Agent GA, and an RDS patch bug.
-
This Week in Change Risk — Week of Sep 7, 2026
A record 970-plus-flaw Patch Tuesday with two exploited zero-days, MikroTik and Citrix NetScaler KEV additions, and Cloudflare Workers wobbles this week.
-
This Week in Change Risk — Week of Aug 31, 2026
AI infrastructure hit the CISA KEV catalog hard this week: LiteLLM, Kestra, and JFrog joined nine new exploited CVEs. Plus SonicWall, PaperCut, and DORA.
-
Azure Outage History: A Timeline of Change-Triggered Failures
A timeline of major Azure outages from 2018 to 2026, and why almost every one traces back to a change: a config push, a code deploy, or a key rotation.
-
Asset Inventory Reconciliation: The Quarterly Change
Running an external asset view against your internal inventory once a quarter turns shadow assets into a change queue. Here is the exact process.
-
Securing Self-Hosted BI Tools: A Change-Control SOP
Metabase, Grafana, Superset and Redash hold credentials to every database they query. A change-managed SOP to get them behind SSO and off the internet.
-
Vanta vs Drata vs Secureframe: Evidence Collection Compared
How Vanta, Drata, and Secureframe handle custom controls, evidence automation, and auditor access — with a named weakness for each GRC platform.
-
Asset Exposure Discovery Tools Compared: 4 Approaches
Shodan, Censys, runZero, and cloud-native inventory each answer BOD 26-04's 'is it publicly exposed?' question differently. Here is how they compare.
-
Asset Criticality Scoring: ACR vs CMDB vs FIPS 199
Your scanner rates asset criticality, your CMDB has a field for it, and NIST has a standard. Here is how the three approaches actually compare.