# Lightwork Security & GRC

> Compliance, made Lightwork.


## Posts

- [Vendor risk for a 40-person company: what auditors sample and what you can skip](https://lightworksecurity.com/vendor-risk-for-a-forty-person-company/): A proportionate third-party programme that satisfies CC9.2 and A.5.19 to A.5.23 without a GRC platform.
- [The Digital Omnibus bought high-risk AI providers fourteen months. Spend them well.](https://lightworksecurity.com/digital-omnibus-ai-governance-plan/): Regulation (EU) 2026/1744 moved the Annex III deadline to 2 December 2027. What changed, what did not, and the order to do the work in.
- [Answering security questionnaires when nobody is the security team](https://lightworksecurity.com/security-questionnaires-without-a-security-team/): How a 30-person company gets through a 200-row questionnaire without inventing controls, and builds the answer library it will reuse.
- [What a certification auditor reads into your Statement of Applicability](https://lightworksecurity.com/reading-your-first-statement-of-applicability/): The SoA is the first document a Stage 1 auditor opens and the test plan for Stage 2. How to write one that holds up.
- [A SOC 2 readiness review in two weeks, with the tools on this site](https://lightworksecurity.com/soc-2-readiness-review-in-two-weeks/): The sequence we use before an audit, compressed into ten working days, with the free tools that carry each step.
- [SOC 2, ISO 27001 or HITRUST: How to Choose Your First Framework](https://lightworksecurity.com/choosing-your-first-framework/): The right first framework depends less on your technology and more on who you sell to. A simple way to decide.
- [ISO 42001 Explained: What It Is and Who Needs It](https://lightworksecurity.com/iso-42001-explained/): ISO/IEC 42001 is the first certifiable standard for AI management systems. Here is what it covers and why customers are starting to ask for it.
- [SOC 2 Type I vs. Type II: Which One Do You Need?](https://lightworksecurity.com/soc-2-type-1-vs-type-2/): Both are SOC 2 reports, but they answer different questions. Here is how to choose, and why many companies do both.

## Pages

- [FedRAMP-20x-Readiness](https://lightworksecurity.com/de/leistungen/fedramp-20x/): FedRAMP 20x für Cloud-native SaaS: Key Security Indicators, automatisierte Validierung, Security Decision Record und Begleitung der unabhängigen Prüfung.
- [CMMC-Readiness](https://lightworksecurity.com/de/leistungen/cmmc/): CMMC Level 1 und Level 2: CUI-Scoping, Gap-Analyse nach NIST SP 800-171, SPRS-Score, SSP und POA&M.
- [HIPAA-Compliance](https://lightworksecurity.com/de/leistungen/hipaa/): HIPAA-Risikoanalyse, Schutzmaßnahmen, BAAs und Nachweise für die Sicherheitsprüfung von US-Gesundheitskunden.
- [DSGVO-Compliance](https://lightworksecurity.com/de/leistungen/dsgvo/): Verarbeitungsverzeichnis, DSFA, TOMs und Betroffenenprozesse, die bei einer Kundenprüfung oder Aufsichtsbehörde standhalten.
- [FedRAMP 20x Readiness](https://lightworksecurity.com/services/fedramp-20x/): FedRAMP 20x readiness for cloud-native SaaS: Key Security Indicators, automated validation, Security Decision Record and independent assessment support.
- [CMMC Readiness](https://lightworksecurity.com/services/cmmc/): CMMC Level 1 and Level 2 readiness: CUI scoping, NIST SP 800-171 gap assessment, SPRS score, SSP and POA&M.
- [HIPAA Compliance](https://lightworksecurity.com/services/hipaa/): HIPAA risk analysis, safeguards, BAAs and records that answer a health system’s security review.
- [GDPR Compliance](https://lightworksecurity.com/services/gdpr/): GDPR records, DPIAs, TOMs and data subject processes that hold up when an EU customer or a supervisory authority asks for proof.
- [Compliance-Kalender](https://lightworksecurity.com/de/compliance-kalender/): 24-Monats-Kalender wiederkehrender Kontrolltätigkeiten und Audit-Meilensteine für SOC 2, ISO 27001, HITRUST und ISO 42001.
- [Readiness Benchmarks](https://lightworksecurity.com/resources/readiness-benchmarks/): Anonymised readiness scores by company size and framework from the Lightwork assessment.
- [Ressourcen](https://lightworksecurity.com/de/ressourcen/): Kostenlose Werkzeuge, Leitfäden und Vorlagen für SOC 2, ISO 27001, HITRUST, ISO 42001 und die KI-Verordnung.
- [KI-Verordnung: Anwendbarkeitsprüfung](https://lightworksecurity.com/de/ki-verordnung-check/): Prüfen Sie, ob ein KI-System unter die EU-KI-Verordnung fällt, welche Pflichten gelten und ab wann.
- [GitHub Security Spot Check](https://lightworksecurity.com/resources/github-spot-check/): Check branch protection, required reviews, Dependabot, secret scanning and 2FA across your GitHub repositories with a read-only token.
- [Trust page](https://lightworksecurity.com/trust-center/): Hosted trust pages for Lightwork clients: certifications, practices, subprocessors and documents on request.
- [Regulatory Watch](https://lightworksecurity.com/resources/regulatory-watch/): Dated changes and coming deadlines across the EU AI Act, NIS2, CRA, US state privacy, HIPAA, CMMC, PCI DSS, ISO 27001 and SOC 2.
- [AI System Register](https://lightworksecurity.com/resources/ai-system-register/): Generate an ISO 42001 AI system record with EU AI Act classification and the Annex IV documentation outline.
- [Bulk Questionnaire Drafting](https://lightworksecurity.com/resources/questionnaire-bulk/): Upload a whole security questionnaire and get draft answers, control references and evidence for every row.
- [Policy Generator](https://lightworksecurity.com/resources/policy-generator/): Generate the four starter policies as Word files with your company details and commitments filled in.
- [Audit Simulator](https://lightworksecurity.com/resources/audit-simulator/): Rehearse SOC 2 or ISO 27001 fieldwork with an AI auditor and get a readiness report with findings.
- [Workspace](https://lightworksecurity.com/workspace/): Save and share your SOC 2, ISO 27001 and ISO 42001 tool states with your team.
- [Vendor Risk Playbook](https://lightworksecurity.com/resources/vendor-risk-playbook/): Inventory, tiering, a 32-question vendor questionnaire, SOC 2 report review and CUEC tracking for third-party risk.
- [ISO 27001 Annex A Evidence Guide](https://lightworksecurity.com/resources/iso-27001-annex-a-evidence-guide/): Typical evidence for each of the 93 ISO 27001:2022 Annex A controls.
- [ISO 42001 Statement of Applicability Builder](https://lightworksecurity.com/resources/iso-42001-soa-builder/): Build an ISO 42001 Statement of Applicability across all 38 Annex A controls, by provider or user role, plus an AI risk register worksheet.
- [ISO 27001 Statement of Applicability Builder](https://lightworksecurity.com/resources/iso-27001-soa-builder/): Build an ISO 27001:2022 Statement of Applicability across all 93 Annex A controls, with 2013 mapping and typical evidence.
- [SOC 2 Control Explorer](https://lightworksecurity.com/resources/soc-2-control-explorer/): Every SOC 2 criterion with what auditors test, common gaps and evidence; mark your status and download the gap list.
- [Compliance Calendar Generator](https://lightworksecurity.com/resources/compliance-calendar/): Download a 24-month calendar of recurring control activities and audit milestones for SOC 2, ISO 27001, HITRUST and ISO 42001.
- [EU AI Act Applicability Checker](https://lightworksecurity.com/resources/eu-ai-act-checker/): Find out whether an AI system falls under the EU AI Act, which obligations apply and when.
- [Security Questionnaire Helper](https://lightworksecurity.com/resources/questionnaire-helper/): Paste a vendor questionnaire question and get a draft answer, the control behind it and the evidence to attach.
- [50 Security Questionnaire Questions, Answered](https://lightworksecurity.com/resources/security-questionnaire-answers/): The 50 questions on nearly every vendor security questionnaire, with the control behind each, a draft answer and the evidence to attach.
- [Policy Starter Pack](https://lightworksecurity.com/resources/policy-starter-pack/): Four audit-ready policies in Word format with framework mapping tables. Free download.
- [How to Choose an Auditor](https://lightworksecurity.com/resources/how-to-choose-an-auditor/): Which auditor can issue your SOC 2, ISO or HITRUST certification, the ten questions to ask before you sign, red flags, and big-firm vs boutique trade-offs.
- [Audit Evidence Checklists](https://lightworksecurity.com/resources/audit-evidence-checklists/): The artifacts auditors actually ask for, organized by framework: SOC 2, ISO 27001, HITRUST and ISO 42001.
- [Questions Your Auditor Will Ask](https://lightworksecurity.com/resources/questions-your-auditor-will-ask/): The 22 questions that come up in nearly every SOC 2 and ISO 27001 audit, what the auditor is really checking, and what a good answer looks like.
- [ISO 42001 Starter Guide](https://lightworksecurity.com/resources/iso-42001-starter-guide/): A practical introduction to ISO/IEC 42001: who needs it, the eight building blocks of an AI management system, a 90-day plan and how it relates to the EU AI Act.
- [SOC 2 Readiness Checklist](https://lightworksecurity.com/resources/soc-2-readiness-checklist/): A 40-point SOC 2 readiness checklist, organized the way auditors think, with what evidence they will ask for at each step.
- [Compliance Glossary](https://lightworksecurity.com/resources/compliance-glossary/): Plain-English definitions of the terms you meet in SOC 2, ISO 27001, HITRUST, ISO 42001 and the EU AI Act.
- [What SOC 2 Really Costs](https://lightworksecurity.com/resources/soc-2-cost-guide/): An honest 2026 breakdown of SOC 2 costs: auditor fees, platforms, consulting, your team’s time and the hidden items, plus a budget estimator.
- [Resources](https://lightworksecurity.com/resources/): Free guides, checklists, templates and tools for SOC 2, ISO 27001, HITRUST, ISO 42001 and the EU AI Act.
- [vCISO-Leistungen](https://lightworksecurity.com/de/leistungen/vciso/): Ein virtueller Chief Information Security Officer bringt erfahrene Sicherheitsführung als flexiblen Retainer: Strategie, Compliance, Berichte an die Geschäftsleitung und Incident-Bereitschaft.
- [ISO/IEC 42001 KI-Managementsysteme](https://lightworksecurity.com/de/leistungen/iso-42001/): ISO 42001 ist der erste zertifizierbare internationale Standard für KI-Managementsysteme.
- [ISO/IEC 27001 Einführung](https://lightworksecurity.com/de/leistungen/iso-27001/): ISO 27001 ist der globale Standard für Informationssicherheit.
- [HITRUST Readiness & Zertifizierung](https://lightworksecurity.com/de/leistungen/hitrust/): Kunden im Gesundheitswesen verlangen zunehmend HITRUST. Wir wählen mit Ihnen das passende Assessment-Level und begleiten Sie sicher durch die Validierung.
- [SOC 2 Readiness & Beratung](https://lightworksecurity.com/de/leistungen/soc-2/): Wir bereiten Ihr Unternehmen auf einen sauberen SOC-2-Bericht (Type I oder Type II) vor – damit Sie Sicherheitsfragebögen souverän beantworten und Enterprise-Deals schneller abschließen.
- [Kontakt](https://lightworksecurity.com/de/kontakt/): Buchen Sie direkt ein kostenloses 30-minütiges Erstgespräch oder schreiben Sie uns zu Preisen und allem anderen.
- [Über uns](https://lightworksecurity.com/de/ueber-uns/): Lightwork Security & GRC bereitet wachsende Unternehmen auf Sicherheitsaudits vor, begleitet sie hindurch und baut Programme auf, die sie Jahr für Jahr audit-ready halten.
- [Leistungen](https://lightworksecurity.com/de/leistungen/): Vom ersten SOC-2-Bericht über DSGVO, HIPAA und US-Behördenprogramme bis zu KI-Governance und laufender Security-Führung: Wir helfen wachsenden Unternehmen, das Vertrauen ihrer Kunden zu gewinnen und zu halten.
- [Start](https://lightworksecurity.com/de/): Wir machen wachsende Unternehmen fit für SOC 2, ISO 27001, HITRUST, HIPAA, DSGVO, CMMC, FedRAMP 20x und ISO 42001 – und halten sie dort.
- [Impressum](https://lightworksecurity.com/de/impressum/): Die vollständige Anschrift und die Registerangaben ergänzen wir nach Abschluss der Gründung.
- [Datenschutzerklärung](https://lightworksecurity.com/de/datenschutz/): Die vollständige Anschrift ergänzen wir nach Abschluss der Gründung.
- [Framework Timeline](https://lightworksecurity.com/framework-timeline/): Key milestones for ISO 27001, ISO 42001, HITRUST, NIST CSF 2.0, NIST AI RMF and the EU AI Act, with upcoming dates highlighted.
- [Framework Crosswalk](https://lightworksecurity.com/framework-crosswalk/): Interactive crosswalk mapping common security controls across SOC 2, ISO 27001, HITRUST, ISO 42001 and NIST CSF 2.0.
- [Compliance Timeline Estimator](https://lightworksecurity.com/timeline-estimator/): Estimate how long SOC 2, ISO 27001, HITRUST or ISO 42001 will take, from kickoff to report or certificate, broken down by phase.
- [Free Readiness Assessment](https://lightworksecurity.com/readiness-assessment/): Free compliance readiness assessment: get a readiness score for SOC 2, ISO 27001, HITRUST and ISO 42001 in about 4 minutes.
- [Contact](https://lightworksecurity.com/contact/): Book a free 30-minute consultation or ask about pricing for SOC 2, HITRUST, ISO 27001, ISO 42001 and vCISO services.
- [Responsible Disclosure](https://lightworksecurity.com/responsible-disclosure/): How to report a security vulnerability in the Lightwork Security & GRC website.
- [Accessibility](https://lightworksecurity.com/accessibility/): Our commitment to an accessible website and how to reach us if you have trouble using it.
- [Terms of Use](https://lightworksecurity.com/terms/): Terms of use for the Lightwork Security & GRC website.
- [Insights](https://lightworksecurity.com/insights/)
- [Newsletter](https://lightworksecurity.com/newsletter/): The Lightwork Brief: a monthly email with framework updates, practical tips and what auditors are asking for right now.
- [Trust Center](https://lightworksecurity.com/trust/): How Lightwork Security & GRC protects client information: confidentiality, access control, encryption and responsible disclosure.
- [FAQ](https://lightworksecurity.com/faq/): Answers to common questions about compliance consulting, timelines, pricing, auditors and how we work.
- [About](https://lightworksecurity.com/about/): Lightwork Security & GRC helps growing companies prepare for and pass security audits, and stay audit-ready year after year.
- [Pricing & Engagement Models](https://lightworksecurity.com/engagement-models/): Flexible engagement models: fixed-fee readiness projects, vCISO retainers and advisory hours. Contact us for a quote.
- [Our Approach](https://lightworksecurity.com/approach/): The Lightwork Method: practical, right-sized compliance with evidence collected once and reused across every framework.
- [Industries](https://lightworksecurity.com/industries/): Compliance consulting for SaaS and technology, healthcare and HealthTech, and AI and machine learning companies.
- [Which Framework Do I Need?](https://lightworksecurity.com/which-framework/): SOC 2, ISO 27001, HITRUST or ISO 42001? Find the compliance framework your customers actually expect.
- [Home](https://lightworksecurity.com/): Security and compliance consulting for growing companies. SOC 2, HITRUST, ISO 27001, ISO 42001 and vCISO, made Lightwork.
- [vCISO Services](https://lightworksecurity.com/services/vciso/): vCISO services: experienced security leadership, compliance ownership and board reporting on a flexible monthly retainer.
- [ISO/IEC 42001 AI Management Systems](https://lightworksecurity.com/services/iso-42001/): ISO/IEC 42001 AI management systems: govern AI responsibly and prove it with an internationally recognized certification.
- [ISO/IEC 27001 Implementation](https://lightworksecurity.com/services/iso-27001/): ISO/IEC 27001:2022 implementation: build an ISMS that earns certification and actually runs your security program.
- [HITRUST Readiness & Certification Support](https://lightworksecurity.com/services/hitrust/): HITRUST e1, i1 and r2 readiness and certification support for companies that handle health data.
- [SOC 2 Readiness & Advisory](https://lightworksecurity.com/services/soc-2/): SOC 2 Type I and Type II readiness: scoping, gap assessment, remediation, evidence and audit support from Lightwork Security & GRC.
- [Services](https://lightworksecurity.com/services/): SOC 2, HITRUST, ISO 27001, ISO 42001 and vCISO services that get growing companies audit-ready and keep them there.
- [Privacy Policy](https://lightworksecurity.com/privacy-policy/): How Lightwork Security & GRC collects, uses and protects personal information on this website.


[comment]: # (Generated by Hostinger Tools Plugin)