Guides
Practical, sourced guides on access reviews, vendor bank-change verification and recurring-controls evidence. Every claim is cited; every guide ends with the tool it comes from.
AttestProof
Access review software for small teams: the price ladder
What user access review software costs for a small team, tier by tier, with cited prices, and how to pick the cheapest tool that still fits.
Published 11 Nov 2026
BankChangeProof
Cooling-off period for vendor bank changes: how long
How long to hold a vendor bank change before the first payment, why the hold helps after a clean callback, and what to do when a request is urgent.
Published 3 Nov 2026
ControlLedger
Compliance attestation vs verification: what each proves
What an attestation, a screenshot, an export and a test each prove to an insurer or auditor, and how to make attested evidence hold up.
Published 30 Oct 2026
AttestProof
Why access reviews get rubber-stamped, and five fixes
Reviewers approve every row when the form makes that the easy answer. Why it happens, five fixes, and the numbers that show a review is real.
Published 27 Oct 2026
BankChangeProof
Vendor payment fraud: documentation for an insurance claim
After a vendor bank-change fraud, your bank, insurer and auditor ask for the same record. What to collect, in what order, and why each item is asked for.
Published 23 Oct 2026
ControlLedger
MFA coverage evidence: Microsoft 365 and Google Workspace
Which MFA report to export from Microsoft 365 and Google Workspace each month, what it must show, and how to hash and file it as evidence.
Published 20 Oct 2026
AttestProof
Entra access reviews without P2: a CSV method
Entra access reviews need P2 or ID Governance. How to export users, groups, roles and app assignments and run the review without them.
Published 16 Oct 2026
BankChangeProof
Callback verification for vendor payment changes
The callback rule for vendor bank changes: the number in the email is never the number you call. Where a verified number comes from, and what to log.
Published 13 Oct 2026
ControlLedger
Break-glass account testing: a quarterly checklist
A quarterly checklist for testing break-glass (emergency access) accounts: sign in, confirm the alert fired, re-store the credential, keep the record.
Published 9 Oct 2026
AttestProof
How to run a quarterly access review, step by step
A quarterly access review in five steps: scope by risk, export, split by reviewer, chase on a fixed schedule, then close and compare with last quarter.
Published 6 Oct 2026
BankChangeProof
“Our banking details have changed”: the first ten minutes
A vendor email says the bank details changed. What to do in the first ten minutes, in order: what to skip, who to call, and what to record.
Published 29 Sep 2026
ControlLedger
How to document a backup restore test
A template for documenting a backup restore test, why job success is not proof of restorability, and the fields an auditor actually checks.
Published 28 Sep 2026
BankChangeProof
How to verify a vendor bank account change, step by step
The six steps to verify a vendor bank account change request, the fields to record at each step, and why callbacks catch what email cannot.
Published 28 Sep 2026
AttestProof
User access review template (CSV + checklist)
A free CSV access review template with reviewer sign-off columns and a close-out checklist, the columns AttestProof imports directly.
Published 28 Sep 2026
BankChangeProof
Vendor banking change policy: a one-page template
A one-page vendor bank change policy template with the callback rule, hold period and approvers written in, and why insurers ask for it in writing.
Published 28 Sep 2026
AttestProof
What auditors actually ask for in an access review
What a SOC 2 or ISO auditor asks to see in an access review, quoted from practitioners, and the artifacts that answer each ask.
Published 28 Sep 2026
ControlLedger
What cyber-insurance carriers ask MSPs to prove at renewal
What cyber-insurance carriers ask MSPs to prove at renewal, quoted verbatim, and the evidence calendar that answers each question.
Published 28 Sep 2026