The Audit Window

On a Friday at ten to five, an email arrives with two lines: send me everything you hold about me, and delete my account. The one month clock started when it landed.

Mira and Cal follow that request through a small software company and sit in the reviewer's chair: the received date, who checked identity, which systems were searched, who reviewed the package, and the day the answer went out. They explain the one month deadline in Article 12 and the extension rule, how to confirm who is asking without collecting a passport scan, why logs with IP addresses count, what to do about backups when someone asks for erasure, how to correct data and tell the recipients, what data portability covers, and what a record of processing is for. They also cover the controller and processor question for a company that sells to businesses, and where Safeguard fits on the software evidence side without making anyone compliant.

Before that, three stories: the noyb complaints against Scale AI filed on 27 October (allegations, with the company's response), the French regulator's fine against Extia over erasure requests, and the draft EDPB guidelines on fines that are open for comment until 13 November. Theo asks whether your deletion button really deletes, and the episode ends with a checklist for before your window opens.

If you run a small software company and need to answer GDPR data subject requests, this episode covers the one month deadline under Article 12, identity checks, the right of access, the right to erasure and backups, rectification, data portability, the record of processing under Article 30, controller and processor roles, and the audit evidence a regulator or customer reviewer asks to see.

A hospital group says yes to your demo, then sends a contract with three letters in the title. B A A. There is no HIPAA certificate you can hold up, so what will they ask you to show?

Mira and Cal sit in the reviewer's chair for a small software vendor's first request list from a hospital's privacy lead: a dated risk analysis, the sub-processor agreements, log review proof, training records and a breach notification path. They explain who counts as a business associate, what the rule says a B A A must contain, what required and addressable really mean, why the risk analysis comes first, and where the proposed Security Rule rewrite stands (a proposal, with a federal target of July 2027).

Before that, two late October stories about patient data in someone else's system: the Quest Diagnostics filing about unauthorized access to a system clinics use for lab orders, and a Denver Health Medical Plan vendor incident involving an access key on a public website. Theo asks where a patient's name ends up in your company that is not the database. The episode ends with a checklist for before your window opens.

Topics: HIPAA, business associate agreement (BAA), Security Rule, risk analysis, required and addressable, breach notification, vendor risk, SaaS compliance, Quest Diagnostics, Denver Health Medical Plan.

Chapters
00:00 Cold open
00:46 Intro
01:14 News: two late October stories on vendors and patient data
05:14 Audit story: a hospital's request list, from the reviewer's chair
08:19 Deep dive: business associates, the BAA and the Security Rule
14:30 Practitioner corner
15:41 Before your window opens
17:15 Outro

Sources
HIPAA: what it is and who has to comply: https://safeguard.sh/resources/blog/hipaa-what-it-is-and-who-needs-to-comply?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
HIPAA audit findings: why risk analysis tops the list: https://safeguard.sh/resources/blog/hipaa-audit-findings-risk-analysis-first?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
HIPAA compliance checklist for SaaS companies: https://safeguard.sh/resources/blog/hipaa-compliance-checklist-for-saas?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
HIPAA glossary: the terms engineers and buyers mix up: https://safeguard.sh/resources/blog/hipaa-glossary-plain-language-terms?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
How do you answer HIPAA questions on a customer security que: https://safeguard.sh/resources/blog/answering-customer-security-questionnaires-hipaa-questions?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
What should a startup do in its first 90 days of HIPAA?: https://safeguard.sh/resources/blog/hipaa-first-90-days-for-a-startup?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
HIPAA Security Rule: how to automate evidence collection: https://safeguard.sh/resources/blog/hipaa-security-rule-automating-evidence-collection?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
How do software supply chain controls map to HIPAA?: https://safeguard.sh/resources/blog/hipaa-software-supply-chain-controls-mapped?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02
HIPAA Security Rule in Safeguard: risk analysis, safeguards : https://safeguard.sh/resources/blog/hipaa-security-rule-in-safeguard-risk-analysis-technical-safeguards-and-evidence?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep02

A buyer asks for an ISO 27001 certificate when you already hold a SOC 2 report. How much of the work do you get to keep? Mira and Cal sit in the auditor's chair for a first ISO audit, from stage 1 documentation review to stage 2 testing and the surveillance visits that follow.

They explain what the Statement of Applicability is, how Annex A (2022) is organised into 93 controls in four themes, why the management system around the controls is the part a SOC 2 never asks you to build, and which evidence (change and vulnerability management, access reviews, scan results) carries over. Before that, two October stories on paper trails: the DHS order on DeepSeek products in the Federal Register and the EDPB's anonymisation consultation. Theo takes a question to settle before you write a word of the ISMS: is your ISO scope the same as your SOC 2 system boundary? The episode ends with a checklist for before your window opens.

Topics: ISO 27001, SOC 2, Statement of Applicability, Annex A (2022), management system, stage 1 and stage 2 audit, surveillance audit, scope, DHS Order #2026-01, EDPB anonymisation.

Chapters
00:00 Cold open
00:34 Intro
00:54 News: the DHS supplier order and the EDPB anonymisation consultation
03:23 Audit story: a first ISO 27001 audit, stage 1 to stage 2
05:52 Deep dive: the Statement of Applicability, Annex A and what carries over from SOC 2
09:43 Practitioner corner
10:39 Before your window opens
11:40 Outro

Sources
What is ISO 27001?: https://safeguard.sh/resources/blog/what-is-iso-27001?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
ISO 27001:2022 Annex A controls guide: https://safeguard.sh/resources/blog/iso-27001-annex-a-controls-guide?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
ISO 27001 certification: complete guide and requirements: https://safeguard.sh/resources/blog/iso-27001-certification-complete-guide-and-requirements?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
ISO 27001 compliance for software development teams: https://safeguard.sh/resources/blog/iso-27001-compliance-for-software-development-teams?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
ISO 27001 risk assessment: how to conduct one: https://safeguard.sh/resources/blog/iso-27001-risk-assessment-how-to-conduct-one?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
ISO 27001 monitoring between surveillance audits: https://safeguard.sh/resources/blog/iso-27001-monitoring-between-surveillance-audits?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
ISO 27001 vs SOC 2: which framework is right for you: https://safeguard.sh/resources/blog/iso-27001-vs-soc-2-which-framework-is-right-for-you?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
Your first SOC 2 audit should not require your first complia: https://safeguard.sh/resources/blog/scale-up-soc2-iso-compliance-without-a-team?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
SOC 2 Type II vs ISO 27001: what each certification actually: https://safeguard.sh/resources/blog/soc-2-type-ii-vs-iso-27001-what-each-certification-actually-covers?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01
DHS Exclusion and Removal Order #2026-01, Federal Register n: https://www.federalregister.gov/d/2026-21447?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=ep01

Trailer for The Audit Window, a weekly compliance podcast for security, GRC and startup teams: SOC 2 Type 1 and Type 2, ISO 27001, HIPAA, vendor risk management (TPRM), audit evidence, compliance automation, security questionnaires and audit readiness. Mira and Cal explain what your auditor will ask for and what you can show them. New episodes every Tuesday.

Learn more at safeguard.sh: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=trailer

Topics: SOC 2, ISO 27001, HIPAA, TPRM, vendor risk, audit readiness, auditor, observation window, compliance automation.