Insights from Workstreet

CAIQ v4.1 is live and STAR still accepts v4.0 through Dec 2027. No panic rebuild today - here is the CSA timeline, what changed, and a practical remapping plan.

Pure SaaS is generally out of the EU Cyber Resilience Act - but remote data processing and buyer questionnaires can still pull you in. Scope test and Article 14 timeline.

Enterprise buyers added AI/LLM sections SOC 2 doesn’t cover. Here’s how to answer model, prompt, and training-data questions with evidence—not slogans.

An AI-BOM is a living inventory of models, data categories, deps, and provenance. Here is why enterprise buyers ask - and a practical first checklist for SaaS.

Most US SaaS firms are not directly regulated by NIS2 - but EU buyers still ask. Here is how Article 21 supply-chain duty pulls you in, and what evidence unblocks reviews.

Enterprise buyers now probe shadow AI in your SaaS-out-of-scope data, undisclosed AI paths, and paste-into-LLM risk. Here is the governance pack to answer.

AICPA has no dedicated AI module yet. Here is the AI-specific evidence auditors map to Trust Services Criteria for SOC 2 Type 2 in 2026.

Already have SOC 2 or ISO 27001? Learn what ISO 42001 adds for AI governance, when buyers ask for it, and when questionnaires are still enough.

How ISO 42001 can work for small and scaling startups.

Here's how to use an AI agent to review code and stay audit-ready. 

Moving from FedRAMP Rev 5 to 20x means building a new complaince program in parallel. Here are the transition steps, deadlines, and tooling changes to plan for.

A founder’s guide on when to get a pen test, what it costs, the types available, and what to do with findings.

A founder's map of SOC 2, ISO 27001, HIPAA, and AI compliance (with costs and timelines).

FedRAMP 20x ballpark costs broken for readiness work and audits for companies starting with SOC 2.

‍

A breakdown of FedRAMP authorization costs and where the money goes.