Practical resources built from official sources and the Agent Index dataset. Read them online; DPDP and SOC 2 also have a PDF. Each one cites its sources and shows when it was last reviewed.
Free through Q1 2027
SOC 2 Type I & II evidence, ISO 27001:2022 Annex A, India DPDP & CERT-In AI-agent controls, a vendor-questionnaire fast-answer kit, and an enterprise AI-use policy. 100% free through Q1 2027.
Unlocked. Direct downloads — no paywall. 100% free through Q1 2027.
ISMAP · Japan · 27 Oct 2026
Registered ISMAP audit institutions from the official ISMAP audit institution list, with registration numbers and how to verify. Not a ranking.
EU AI Act · 26 Oct 2026
Every sourced AI Act date after Regulation (EU) 2026/1744: high-risk rules move to 2 Dec 2027 and 2 Aug 2028; new bans apply 2 Dec 2026. EN 18286 and the Council’s 21 Oct 2026 Digital Omnibus mandate.
Calendar · 2025–2028
Sourced statutory and standard dates for ISO 27001, PCI DSS, DORA, the EU AI Act, CMMC, DPDP, CERT-In and NIS2, plus a downloadable .ics and 30-day email reminders.
Frameworks · picker
Look into SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, DPDP, CERT-In, FedRAMP, CMMC, DORA, the EU AI Act and NIS2 from official sources. A static guide plus a small picker. Not a ranking.
Cost · published prices
Platform and pentest figures compiled from vendor-published prices (20 Oct 2026), plus a client-side sum of the line items you select. Real quotes vary.
SOC 2 · auditors
SOC 1/2/3, Type 1 vs Type 2, observation period, pentest as a TSC example, independence, and how to verify a CPA or ISO certificate.
Templates · SOC 2 · ISO 27001
SOC 2 and ISO/IEC 27001:2022 readiness checklists, evidence examples, policy outlines, common exceptions, a vendor-questionnaire kit and an AI-use outline. Working aids, not requirements.
Templates · pack
Five printable working aids in Markdown, CSV and HTML. One free newsletter signup unlocks the kit. The open dataset (CC BY 4.0) is free to download with no sign-up.
After the audit
SOC 2 vs SOC 3 sharing, listed trust-center and questionnaire agents (alphabetical, not a ranking), and the ISO calendar-year audit rule.
SOC 2 · ISO 27001
Category-level overlap and ISO-specific work, with a link to the official AICPA mapping spreadsheet. Not a control-by-control map.
India · CERT-In · auditors
How CERT-In auditor empanelment works, how to check a firm on the official PDF, and empanelled firms by city from this directory. Not a ranking.
PCI DSS · QSA · auditors
How PCI SSC qualifies QSA companies, what In Remediation means, and verified QSA firms by country from this directory. Not a ranking.
HITRUST · assessors
How HITRUST’s Authorized External Assessor list works, what HITRUST says about due diligence, and verified assessor firms in this directory. Not a ranking.
ISO 27001 · certification bodies
How to check that an ISO/IEC 27001 certification body is accredited, which national register to look up, and verified bodies by country. Not a ranking.
FedRAMP · 3PAO · auditors
How FedRAMP recognizes third-party assessors (A2LA accreditation), how to verify a 3PAO, and FedRAMP assessors in this directory. Not a ranking.
GovRAMP · 3PAO · 27 Oct 2026
The 32 A2LA-accredited 3PAOs listed by GovRAMP, which are in this directory, and how Ready and Authorized assessments work. Sourced.
CMMC · C3PAO · auditors
What a CMMC Third-Party Assessment Organization is, what the Cyber AB requires, and C3PAOs in this directory. Not a ranking.
Report · Q4 2026
Cited counts from the open dataset: agents, audit firms, HQ countries, pricing transparency, authorizations and accreditation coverage. Free, CC BY 4.0.
SOC 2 · partners
Audit firms listed on Vanta’s and Drata’s partner directories, with each firm’s verified registry listings. A directory listing is not an endorsement.
India · CERT-In · DPDP
What the 15 Oct 2026 Critical advisory says, a control-by-control checklist mapped to listed agents, and how it sits next to the 2022 CERT-In Directions and the DPDP Act.
India · DPDP
Every DPDP Act 2023 and DPDP Rules 2025 duty that matters when AI agents touch personal data, with the official timeline to 13 May 2027, penalties and vendor questions.
SOC 2 · 2026
Scope against the AICPA Trust Services Criteria, avoid the auditor-independence red flags the AICPA raised in 2026, and compare SOC 2 tools from our dataset.
Weekly, free, unsubscribe anytime.
Check your inbox to confirm your email. We’ll only send the weekly brief after you click the link.
We use your email only to send the newsletter. See our privacy policy.