Travis Good

Architect of security and privacy programs for 1,000+ hypergrowth companies. Author of "Complete Cloud Compliance," HITRUST 3rd Party Council member, and recognized speaker on startup security.

Illustration for CSA SSCF-CAIQ and SaaS product security controls
CASE STUDY
Travis Good
decorative
September 29, 2026

SOC 2 Doesn't Answer "What Can the Customer Configure?" - CSA's SSCF-CAIQ for SaaS Vendors

SOC 2 covers how your company operates. CSA's SSCF-CAIQ covers customer-facing SaaS controls - SSO, MFA, logs - so buyers stop sending custom packs.
Read Post
CASE STUDY
Travis Good
decorative
September 29, 2026

FedRAMP 20x Requirements: KSIs, Classes and Key Dates

Learn the how FedRAMP 20x is changing FedRAMP compliance.

Read Post
Illustration for NYDFS Part 500 and SaaS vendor contract requirements
CASE STUDY
Travis Good
decorative
September 28, 2026

NY Financial Buyers Are Hardening Vendor Contracts - What NYDFS Part 500 Means for SaaS

Private SaaS is not the NYDFS Covered Entity - your NY bank or insurer customer is. Part 500.11 still lands MFA, encryption, and event notice in your MSA.
Read Post
Illustration for HECVAT vs SOC 2 for higher-ed SaaS vendors
CASE STUDY
Travis Good
decorative
September 28, 2026

Your SOC 2 Won't Clear HECVAT - What Higher-Ed Buyers Actually Want from SaaS Vendors

SOC 2 does not replace HECVAT for higher-ed deals. HECVAT 4 is a self-assessment workbook - accessibility, FERPA privacy, and AI/ML that SOC 2 skips.
Read Post
Illustration for SEC cyber disclosure and SaaS vendor incident notification SLAs
CASE STUDY
Travis Good
decorative
September 28, 2026

Public Buyers Want 24-48 Hour Incident Notice - What the SEC Cyber Rule Means for Private SaaS

Private SaaS is not the SEC Item 1.05 filer - public buyers are. Expect 24-72h notice in MSAs so they can hit the four-business-day 8-K clock.
Read Post
Illustration for US state privacy laws and SaaS compliance programs
CASE STUDY
Travis Good
decorative
September 28, 2026

Twenty State Privacy Laws, One SaaS Program - What Actually Changed in 2026

Roughly twenty US state privacy laws now face nationwide SaaS teams. Build one program. 2026 deltas: TDPSA, MODPA, GPC, and unified ops stack.
Read Post
Illustration for SOC 2 penetration testing cadence for SaaS
CASE STUDY
Travis Good
decorative
September 28, 2026

Is an Annual Pentest Enough for SOC 2? What Auditors and SaaS Buyers Expect in 2026

SOC 2 does not name pentesting, but auditors and buyers expect recent third-party evidence. Cadence, window timing, and the report pack that closes asks.
Read Post
Illustration for UK Cyber Essentials certification for US SaaS selling into the UK
CASE STUDY
Travis Good
decorative
September 28, 2026

UK Buyer Asked for Cyber Essentials - Does SOC 2 Count, and What Changed in April 2026?

SOC 2 does not replace UK Cyber Essentials for UK bids. Non-UK SaaS can certify remotely - April 2026 MFA and EOL rules, plus G-Cloud 15 stakes.
Read Post
CASE STUDY
Travis Good
decorative
September 28, 2026

What is FedRAMP 20x? Everything You Need to Know

FedRAMP 20x is designed to streamline the FedRAMP process and create new federal opportunities for Cloud Service Providers.

Read Post