WORKSTREET BLOG
Insights from Workstreet
Guides, articles, and more on compliance, privacy and security.
CASE STUDY
Travis Good
October 13, 2026
Do You Need FedRAMP to Sell to the Government?
What you need to know about FedRAMP requirements and if it's the right next step for your business.
CASE STUDY
Travis Good
October 5, 2026
Penetration Testing Requirements: Written Into the Standard, Expected in Practice, or Only Proposed
Which frameworks require a pen test? From PCI DSS and FedRAMP to SOC 2, ISO 27001, and HIPAA, we break down when pen testing is a requirement.
CASE STUDY
Travis Good
October 2, 2026
Does Colorado's New ADMT Law Apply to Our SaaS - and What Docs / Notices Do We Owe by January 1, 2027?
Colorado SB 26-189 replaces the 2024 AI Act. Developer vs deployer checklist, covered ADMT exclusions, and Jan 1 2027 notice clocks for SaaS.
CASE STUDY
Travis Good
October 2, 2026
SOC 2 Won't Clear Multi-State SLED Deals - What GovRAMP (Formerly StateRAMP) Actually Requires
SOC 2 is not GovRAMP for multi-state SLED SaaS. Status ladder (Core/Ready/Authorized), StateRAMP rename, FedRAMP Fast Track one-way, NC Apr 2026-2027.
CASE STUDY
Travis Good
October 1, 2026
SOC 2 Won't Clear a Texas Agency Deal - What TX-RAMP Actually Requires for SaaS
SOC 2 does not replace TX-RAMP for Texas agency SaaS deals. Level 1 vs 2, Manual 4.0 provisional, Fast Track, and why hyperscaler cert is not yours.
CASE STUDY
Travis Good
October 1, 2026
Does the EU Data Act Apply to Our SaaS - and What Do Buyers Expect Before January 2027?
Most B2B SaaS is a Data Act data processing service. Switching clocks, portability, and Trust Center disclosures buyers expect before January 2027.
CASE STUDY
Travis Good
September 30, 2026
We Already Completed SIG - Do We Need to Remake It for SIG 2026?
SIG 2026 deepens AI (ISO 42001) and resilience mappings without new domains. Remap AI and ORF rows if buyers ask for 2026 - not a zero rewrite.
CASE STUDY
Travis Good
September 30, 2026
SOC 2 Won't Clear an Australian Government Deal - What IRAP Actually Is for US SaaS
SOC 2 does not replace an IRAP assessment for Australian government cloud. What IRAP is, why hyperscaler coverage is not yours, and a US SaaS playbook.
CASE STUDY
Travis Good
September 29, 2026
CCPA Cybersecurity Audits Are Live - Does Your SaaS Need One?
Not every CCPA business needs an annual cyber audit. Significant-risk thresholds, the 2028 certification clock, and what SaaS vendors should prepare.
CASE STUDY
Travis Good
September 29, 2026
SOC 2 Doesn't Answer "What Can the Customer Configure?" - CSA's SSCF-CAIQ for SaaS Vendors
SOC 2 covers how your company operates. CSA's SSCF-CAIQ covers customer-facing SaaS controls - SSO, MFA, logs - so buyers stop sending custom packs.
CASE STUDY
Travis Good
September 29, 2026
FedRAMP 20x Requirements: KSIs, Classes and Key Dates
Learn the how FedRAMP 20x is changing FedRAMP compliance.
CASE STUDY
Travis Good
September 28, 2026
NY Financial Buyers Are Hardening Vendor Contracts - What NYDFS Part 500 Means for SaaS
Private SaaS is not the NYDFS Covered Entity - your NY bank or insurer customer is. Part 500.11 still lands MFA, encryption, and event notice in your MSA.
CASE STUDY
Travis Good
September 28, 2026
Your SOC 2 Won't Clear HECVAT - What Higher-Ed Buyers Actually Want from SaaS Vendors
SOC 2 does not replace HECVAT for higher-ed deals. HECVAT 4 is a self-assessment workbook - accessibility, FERPA privacy, and AI/ML that SOC 2 skips.
CASE STUDY
Travis Good
September 28, 2026
Public Buyers Want 24-48 Hour Incident Notice - What the SEC Cyber Rule Means for Private SaaS
Private SaaS is not the SEC Item 1.05 filer - public buyers are. Expect 24-72h notice in MSAs so they can hit the four-business-day 8-K clock.
CASE STUDY
Travis Good
September 28, 2026
Twenty State Privacy Laws, One SaaS Program - What Actually Changed in 2026
Roughly twenty US state privacy laws now face nationwide SaaS teams. Build one program. 2026 deltas: TDPSA, MODPA, GPC, and unified ops stack.
Ready to Transform Security into a Growth Advantage?
Schedule a consultation with our trust solutions experts to see how we can accelerate your security program and compliance journey.