Institute Technical Papers

Everything you need to know about SOC 2 Type II — from the observation period and evidence collection to what auditors test, how to maintain year-round readiness, and how to use your Type II report to close enterprise deals.

A complete guide to the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection — what it covers, who it applies to, key requirements, sector-specific considerations, and how to build a UAE PDPL compliance program.

A complete guide to the CSA Cloud Controls Matrix (CCM) — what it covers, how it maps to other standards, how to complete the CAIQ, and how cloud providers use STAR certification to demonstrate security assurance.

A complete guide to cloud security assessments — what they cover, how to assess IAM, network, data, logging, and compliance controls across AWS, Azure, and GCP, and how to build a continuous cloud security posture.

A complete guide to cybersecurity maturity assessments — what they measure, the frameworks used (NIST CSF, CIS Controls, CMM), how assessments are conducted, and how to use results to build a prioritised security improvement roadmap.

A deep-dive into SOC 1 Type II — how the observation period works, what auditors test, how to maintain effective ICFR controls year-round, and how to produce a clean report that satisfies your clients' financial auditors.

A complete guide to Google Cloud Platform security reviews — covering IAM, VPC, Cloud Audit Logs, Security Command Center, Chronicle, CIS Benchmarks for GCP, and achieving SOC 2 and ISO 27001 compliance on GCP.

A complete guide to AWS security reviews — covering IAM, VPC, S3, CloudTrail, GuardDuty, Security Hub, CIS Benchmarks for AWS, and how to build a continuously secure AWS environment aligned to SOC 2 and ISO 27001.

A complete guide to ISO/IEC 20000-1, the international standard for IT service management. Learn how to build an SMS that improves service quality, satisfies enterprise clients, and achieves certification.

An in-depth guide to NIST SP 800-53 Revision 5 — the 20 control families, how to select and tailor control baselines, how to implement the most critical controls, and how SP 800-53 relates to FedRAMP, FISMA, and CMMC.