CAIQ v4.1 Is Live — Do You Need to Remake Your STAR Questionnaire?
CAIQ v4.1 is live and STAR still accepts v4.0 through Dec 2027. No panic rebuild today - here is the CSA timeline, what changed, and a practical remapping plan.
Does the EU Cyber Resilience Act Apply to SaaS?
Pure SaaS is generally out of the EU Cyber Resilience Act - but remote data processing and buyer questionnaires can still pull you in. Scope test and Article 14 timeline.
How to Answer the AI Security Questionnaire When SOC 2 Isn’t Enough
Enterprise buyers added AI/LLM sections SOC 2 doesn’t cover. Here’s how to answer model, prompt, and training-data questions with evidence—not slogans.
What Is an AI-BOM - and Will Enterprise Buyers Ask Your SaaS for One?
An AI-BOM is a living inventory of models, data categories, deps, and provenance. Here is why enterprise buyers ask - and a practical first checklist for SaaS.
Does NIS2 Apply to a US SaaS Selling Into the EU?
Most US SaaS firms are not directly regulated by NIS2 - but EU buyers still ask. Here is how Article 21 supply-chain duty pulls you in, and what evidence unblocks reviews.
Shadow AI in Your SaaS: What Enterprise Buyers Ask (and How to Answer)
Enterprise buyers now probe shadow AI in your SaaS-out-of-scope data, undisclosed AI paths, and paste-into-LLM risk. Here is the governance pack to answer.
What AI-Specific Evidence Do Auditors Want for SOC 2 Type 2 in 2026?
AICPA has no dedicated AI module yet. Here is the AI-specific evidence auditors map to Trust Services Criteria for SOC 2 Type 2 in 2026.
Do You Need ISO 42001 If You Already Have SOC 2 (or ISO 27001)?
Already have SOC 2 or ISO 27001? Learn what ISO 42001 adds for AI governance, when buyers ask for it, and when questionnaires are still enough.
Can Small AI Startups Achieve ISO 42001?
How ISO 42001 can work for small and scaling startups.