Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, CPCSC, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Answer a few questions about your company and generate copyable starter Information Security, Access Control, and Acceptable Use policies. These are drafts to adapt, approve, and enforce, not finished audit evidence.
They are strong starting drafts, not finished policies. You must adapt them to what your organization actually does, get them approved by leadership, and enforce them. An auditor checks that a policy exists, is approved, and is followed. A template alone is not evidence of that, which is exactly the gap our auditor management and advocacy work closes.
The structure reflects common expectations across SOC 2, ISO 27001, and similar frameworks: information security, access control, and acceptable use are foundational policies each of them expects you to have.
Yes. Copy them, adapt them, and use them. If you want a full, mapped policy set and the controls to back them up, that is what our ISO 27001 and SOC 2 readiness work delivers. See the full SOC 2 readiness checklist for what an auditor actually looks for.
These three are foundational, but a full program includes more: incident response, vendor management, change management, business continuity, and others. Start here, then build out the rest as your program matures.
Not ready for a call yet?
A few short notes from Jacob on building a policy program that passes audits without months of pain. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.
From Jacob Masse, founder of traztech. No spam, unsubscribe in one click.
Want it done for you?
ISO 27001 Readiness
We build your full policy set and the controls to back it, mapped to ISO 27001.
Explore ISO 27001 Readiness →We build a complete, framework-mapped policy program and stand up the controls that make it real, so your ISO 27001 or SOC 2 audit goes smoothly.
See ISO 27001 Readiness Book a callThis gives you the shape of the problem. traztech Workspace has a policy library mapped to the controls each policy satisfies, with review, approval, and version history, so the document you generate today is still defensible at audit time. Start free and build the whole set.
No credit card, no trial clock, no locked features. Traztech makes money when someone wants help closing the gaps, not from the Workspace itself.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.