Why you can trust this course
We don't ask you to take our word for it. Every claim in every lesson is anchored to a Section, Rule, or judgment. This page is the master register of every authority we cite.
Legal basis snapshot: SOC 2 primary-source stack current to 29 August 2026. Core: AICPA SSAE 18 as currently effective in the April 2026 codification (Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification, issued April 2016). Applicable AT-C sections: AT-C 105 (Concepts Common to All Attestation Engagements), AT-C 205 (Examination Engagements), and AT-C 320 (Reporting on an Examination of Controls at a Service Organization Relevant to User Entities Internal Control Over Financial Reporting, i.e. SOC 1; referenced in Module 1 Lesson 2 for the SOC 1 versus SOC 2 distinction). Frameworks: 2017 Trust Services Criteria with Revised Points of Focus (2022) covering the five TSC categories (Security as Common Criteria mandatory, plus Availability, Processing Integrity, Confidentiality, Privacy as optional); AICPA Description Criteria DC-100 for the management assertion; COSO Internal Control Integrated Framework 2013 (the framework underlying Common Criteria CC1 through CC5); COSO Generative AI Internal Control Guidance February 2026 (non-authoritative, referenced in Module 8 emerging-controls lesson only). Related standards for context (referenced but not primary): ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 (February 2024), HIPAA Security Rule (45 CFR Part 164), FedRAMP. Items requiring ongoing verification and flagged inside the relevant lessons: proposed SSAE revisions to AT-C 105, 205 and 210 per the AICPA Exposure Draft of 26 February 2026 (comment period closed 30 June 2026; no final revised standard issued as of course pin date); AICPA-issued authoritative AI-specific Trust Services Criteria if published after August 2026; any TSC refresh after the 2022 Revised Points of Focus; current pricing on Vanta, Drata, Sprinto, Secureframe and Comply.ai platforms; current AICPA-licensed CPA firm roster and India-facing engagement fees.
How this SOC 2 Readiness Practitioner Certification register is built
This trust page is the citation register for the SOC 2 Readiness Practitioner Certification course. It cites 28 authorities across 8 statutory instruments, drawn from the legal basis snapshot above (SOC 2 primary-source stack current to 29 August 2026. Core: AICPA SSAE 18 as currently effective in the April 2026 codification (Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification, issued April 2016). Applicable AT-C sections: AT-C 105 (Concepts Common to All Attestation Engagements), AT-C 205 (Examination Engagements), and AT-C 320 (Reporting on an Examination of Controls at a Service Organization Relevant to User Entities Internal Control Over Financial Reporting, i.e. SOC 1; referenced in Module 1 Lesson 2 for the SOC 1 versus SOC 2 distinction). Frameworks: 2017 Trust Services Criteria with Revised Points of Focus (2022) covering the five TSC categories (Security as Common Criteria mandatory, plus Availability, Processing Integrity, Confidentiality, Privacy as optional); AICPA Description Criteria DC-100 for the management assertion; COSO Internal Control Integrated Framework 2013 (the framework underlying Common Criteria CC1 through CC5); COSO Generative AI Internal Control Guidance February 2026 (non-authoritative, referenced in Module 8 emerging-controls lesson only). Related standards for context (referenced but not primary): ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 (February 2024), HIPAA Security Rule (45 CFR Part 164), FedRAMP. Items requiring ongoing verification and flagged inside the relevant lessons: proposed SSAE revisions to AT-C 105, 205 and 210 per the AICPA Exposure Draft of 26 February 2026 (comment period closed 30 June 2026; no final revised standard issued as of course pin date); AICPA-issued authoritative AI-specific Trust Services Criteria if published after August 2026; any TSC refresh after the 2022 Revised Points of Focus; current pricing on Vanta, Drata, Sprinto, Secureframe and Comply.ai platforms; current AICPA-licensed CPA firm roster and India-facing engagement fees.).
Primary sources: AICPA Trust Services Criteria 2017 (2022 PoF) (14 entries), SOC 2 Platform Vendor (4 entries), AICPA AT-C Section (3 entries).
Every claim in every SOC 2 Readiness Practitioner Certification lesson traces back to a Section, Rule, or judgment listed below.
If a lesson references a specific obligation, click the [Lx-Cy] marker in that
lesson to jump to the verbatim text in the register.
Our verification promise
- Every factual claim has a source. If we say "Section 9 allows a three-month limitation period", you can click the
[Lx-Cy]marker next to it and read the verbatim text of Section 9 of the Sexual Harassment of Women at Workplace Act, 2013. - Every source is on this page. Below you will find every Section, Rule and judgment we have relied on, grouped by category, with the verbatim text we hold in our register.
- Every source has a public link. Wherever an authoritative public link exists (India Code, the official court website, a reputable law-reports portal), we link to it.
- Bug bounty for errors. If you find a factual error in any lesson, write to [email protected] with the lesson, the claim and the corrected source. We will credit your account ₹1,000 for the first report of any verifiable error, ₹5,000 for a substantial error.
8
modules
40
lessons
28
cited authorities
recent
last reviewed
The full citation register
Every authority used in any lesson appears below. Click a row to expand the verbatim text.
AT-C 105 Concepts Common to All Attestation , Common concepts across attestation engagements 01 Apr 2016
Plain summary: AT-C 105 defines the three attestation engagement types (Examination, Review, Agreed-Upon Procedures), the concepts of subject matter, criteria and evidence sufficiency, and the practitioner reporting responsibilities that apply across all attestation engagements including SOC 2.
AT-C 105 provides the foundational concepts common to all attestation engagements: the responsible party's assertion, the criteria used to evaluate the subject matter, the practitioner's independence requirements, and the concept of sufficient appropriate evidence to reach reasonable assurance (Examination) or limited assurance (Review) conclusions.
AT-C 205 Examination Engagements , Examination engagement standard (SOC 2) 01 Apr 2016
Plain summary: AT-C 205 governs Examination Engagements. This is the standard SOC 2 examinations are performed under. The practitioner obtains sufficient appropriate evidence to conclude on management assertion that (a) description of the service organization system is accurate (both Type I and Type II) and (b) controls are suitably designed (Type I) and operating effectively (Type II) throughout the specified period.
AT-C 205 requires the practitioner performing an examination engagement to obtain sufficient appropriate evidence to reduce attestation risk to an acceptably low level. For a SOC 2 Type I examination, the practitioner tests the fairness of the description of the system and the suitability of design of controls as of a specified date. For a SOC 2 Type II examination, the practitioner additionally tests the operating effectiveness of controls throughout the specified period (typically 3 to 12 months, most commonly 6 to 12 months).
AT-C 320 SOC 1 Reporting on Service Org Controls , SOC 1 reporting section (contrast for SOC 2) 01 Apr 2016
Plain summary: AT-C 320 governs SOC 1 reporting (controls at a service organization relevant to user entities internal control over financial reporting). Referenced in the SOC 2 course for contrast: SOC 1 sits under AT-C 320 and covers financial-reporting controls; SOC 2 sits under AT-C 205 read with the Trust Services Criteria and covers information security controls. Founders sometimes conflate the two report types.
AT-C 320 addresses examinations of controls at a service organization likely to be relevant to user entities' internal control over financial reporting (ICFR). A SOC 1 report under AT-C 320 is aimed at user entity auditors relying on the service organization for financial-reporting completeness. A SOC 2 report under AT-C 205 read with the Trust Services Criteria is aimed at user entity security, procurement and legal teams evaluating information-security posture.
DC-100 Description Criteria for SOC 2 , AICPA Description Criteria for SOC 2 reports 01 Jan 2018
Plain summary: AICPA Description Criteria DC-100 provides the framework for management assertion about the service organization system description in a SOC 2 report. Nine description criteria structure how management describes the system and controls.
DC-100 requires management to describe: DC1 the type of services provided; DC2 the principal service commitments and system requirements; DC3 the components of the system used to provide services (infrastructure, software, people, procedures, data); DC4 the classes of user entity transactions and information flow; DC5 the applicable trust services criteria and related controls; DC6 the complementary user entity controls (CUECs) needed to achieve the criteria; DC7 the complementary sub-service organization controls (CSOCs) when the carve-out method is used; DC8 significant events and conditions during the reporting period; DC9 reporting on incidents.
SSAE 18 Attestation Standards (April 2016) , Statement on Standards for Attestation Engagements No. 18 01 Apr 2016
Plain summary: Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification, issued by the AICPA Auditing Standards Board in April 2016. Currently effective as of the April 2026 codification. Applies to all attestation engagements including SOC 1 (SOC for Service Organizations relevant to financial reporting), SOC 2 (SOC for Service Organizations Trust Services Criteria), and SOC 3 (public-distribution short-form SOC 2). Structure: three engagement types defined at AT-C 105 (Examination, Review, Agreed-Upon Procedures). SOC 2 is an Examination engagement.
SSAE 18 codifies the AICPA attestation standards into a single framework. AT-C 105 sets out common concepts. AT-C 205 governs Examination Engagements (the SOC 2 engagement type). AT-C 210 governs Review Engagements. AT-C 215 governs Agreed-Upon Procedures Engagements. AT-C 320 governs Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1 specific). NOTE: Proposed revisions to AT-C 105, 205 and 210 issued as an Exposure Draft on 26 February 2026, comment period closed 30 June 2026; no final revised standard published as of 22 August 2026.
2017 TSC with Revised Points of Focus (2022) , Current operative TSC document 15 Dec 2022
Plain summary: 2017 Trust Services Criteria with Revised Points of Focus (2022). Five categories: Security (Common Criteria mandatory), Availability, Processing Integrity, Confidentiality, Privacy. Common Criteria structure CC1 through CC9. 2022 refresh added Points of Focus without altering criteria. Key 2022 additions: system documentation must include network and data-flow diagrams plus hardware inventory; asset retrieval and immediate access restriction on employee or contractor termination including remote workforce; patch management process with identification, testing, approval, verification.
The Trust Services Criteria are used by service auditors to conduct SOC 2 examinations. Five categories: Security, Availability, Processing Integrity, Confidentiality, Privacy. Security is the Common Criteria and is applicable to every SOC 2 examination. Common Criteria structure: CC1 Control Environment; CC2 Communication and Information; CC3 Risk Assessment; CC4 Monitoring Activities; CC5 Control Activities; CC6 Logical and Physical Access Controls; CC7 System Operations; CC8 Change Management; CC9 Risk Mitigation. CC1 through CC5 map directly to the five COSO 2013 Internal Control components.
Availability TSC (A-series) , Availability Trust Services Criterion 15 Dec 2022
Plain summary: Availability Trust Services Criterion. Optional. Includes A1.1 (capacity and performance planning), A1.2 (environmental protections and backup / recovery infrastructure) and A1.3 (recovery plan testing).
A1.1 The entity maintains, monitors and evaluates current processing capacity and use of system components (infrastructure, data and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives. A1.2 The entity authorises, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure. A1.3 The entity tests recovery plan procedures supporting system recovery.
CC1 Control Environment , Common Criteria CC1 governance and org structure 15 Dec 2022
Plain summary: Common Criteria CC1 addresses the Control Environment. Corresponds to the COSO 2013 Control Environment component. Requires the entity to demonstrate commitment to integrity and ethical values, board oversight independent of management, appropriate organisational structures and reporting lines, commitment to attract and retain competent people, and accountability for controls.
CC1.1 The entity demonstrates a commitment to integrity and ethical values. CC1.2 The board of directors demonstrates independence from management and exercises oversight. CC1.3 Management establishes structures, reporting lines, and appropriate authorities and responsibilities. CC1.4 The entity demonstrates a commitment to attract, develop, and retain competent individuals. CC1.5 The entity holds individuals accountable for their internal control responsibilities.
CC2 Communication and Information , Common Criteria CC2 15 Dec 2022
Plain summary: Common Criteria CC2 addresses Communication and Information. Corresponds to COSO Information and Communication component. Requires internal information systems, internal communication mechanisms and external communication of security commitments.
CC2.1 The entity obtains or generates and uses relevant, quality information to support the functioning of internal control. CC2.2 The entity internally communicates information necessary to support the functioning of internal control. CC2.3 The entity communicates with external parties regarding matters affecting the functioning of internal control.
CC3 Risk Assessment , Common Criteria CC3 15 Dec 2022
Plain summary: Common Criteria CC3 addresses Risk Assessment. Corresponds to COSO Risk Assessment component. Requires the entity to specify objectives, identify and analyse risks to those objectives, consider fraud risk, and identify and analyse significant change.
CC3.1 The entity specifies objectives with sufficient clarity to enable identification and assessment of risks. CC3.2 The entity identifies risks to the achievement of its objectives and analyses risks as a basis for determining how the risks should be managed. CC3.3 The entity considers the potential for fraud in assessing risks. CC3.4 The entity identifies and assesses changes that could significantly impact the system of internal control.
CC4 Monitoring Activities , Common Criteria CC4 15 Dec 2022
Plain summary: Common Criteria CC4 addresses Monitoring Activities. Corresponds to COSO Monitoring Activities component. Requires ongoing and separate evaluations plus timely communication of deficiencies.
CC4.1 The entity selects, develops, and performs ongoing and separate evaluations to ascertain whether the components of internal control are present and functioning. CC4.2 The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action.
CC5 Control Activities , Common Criteria CC5 15 Dec 2022
Plain summary: Common Criteria CC5 addresses Control Activities. Corresponds to COSO Control Activities component. Requires selection and development of control activities, technology-general controls, and deployment of policies and procedures.
CC5.1 The entity selects and develops control activities that contribute to the mitigation of risks. CC5.2 The entity also selects and develops general control activities over technology to support the achievement of objectives. CC5.3 The entity deploys control activities through policies that establish what is expected and procedures that put policies into action.
CC6 Logical and Physical Access Controls , Common Criteria CC6 15 Dec 2022
Plain summary: Common Criteria CC6 addresses Logical and Physical Access Controls. Includes IAM, MFA, provisioning and deprovisioning, remote access, physical security, cryptographic key management.
CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets. CC6.2 Prior to issuing system credentials, the entity registers and authorises new internal and external users. CC6.3 The entity authorises, modifies, or removes access to data, software, functions and other protected information assets based on roles, responsibilities, or the system design and changes. CC6.4 The entity restricts physical access to facilities and protected information assets. CC6.5 The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data has been diminished. CC6.6 The entity implements logical access security measures to protect against threats from sources outside its system boundaries. CC6.7 The entity restricts the transmission, movement, and removal of information. CC6.8 The entity implements controls to prevent or detect and act upon the introduction of unauthorised or malicious software.
CC7 System Operations , Common Criteria CC7 15 Dec 2022
Plain summary: Common Criteria CC7 addresses System Operations. Includes threat detection, security incident identification and response, backup and recovery, and business continuity operational execution.
CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities and (2) susceptibilities to newly discovered vulnerabilities. CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors. CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure to meet objectives (security incidents) and if so, takes actions to prevent or address such failures. CC7.4 The entity responds to identified security incidents by executing a defined incident-response programme. CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents.
CC8 Change Management , Common Criteria CC8 15 Dec 2022
Plain summary: Common Criteria CC8 addresses Change Management. Includes development lifecycle, testing, approval, deployment and rollback for infrastructure, data and applications.
CC8.1 The entity authorises, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.
CC9 Risk Mitigation , Common Criteria CC9 15 Dec 2022
Plain summary: Common Criteria CC9 addresses Risk Mitigation. Includes business continuity, insurance and vendor / third-party risk management.
CC9.1 The entity identifies, selects and develops risk mitigation activities for risks arising from potential business disruptions. CC9.2 The entity assesses and manages risks associated with vendors and business partners.
Confidentiality TSC (C-series) , Confidentiality Trust Services Criterion 15 Dec 2022
Plain summary: Confidentiality Trust Services Criterion. Optional. Includes data classification, encryption at rest and in transit, retention and disposal of confidential information.
C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality. C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality.
Privacy TSC (P-series) , Privacy Trust Services Criterion 15 Dec 2022
Plain summary: Privacy Trust Services Criterion. Optional. Covers eight sub-criteria on notice, choice and consent, collection, use, retention and disposal, access, disclosure and notification, quality, monitoring and enforcement. Overlaps with GDPR and DPDP Act 2023 obligations.
P1 Notice and Communication of Objectives. P2 Choice and Consent. P3 Collection. P4 Use, Retention, and Disposal. P5 Access. P6 Disclosure and Notification. P7 Quality. P8 Monitoring and Enforcement.
Processing Integrity TSC (PI-series) , Processing Integrity Trust Services Criterion 15 Dec 2022
Plain summary: Processing Integrity Trust Services Criterion. Optional. Covers data validation, completeness, accuracy, timeliness and authorisation of processing.
PI1.1 System processes and system output are complete, accurate, valid, authorised, and timely. PI1.2 System inputs are complete and accurate. PI1.3 System processing is complete, accurate, timely, and authorised to meet the entity's objectives. PI1.4 The entity implements policies and procedures over system output to meet the entity's objectives. PI1.5 The entity stores inputs, items in processing, and outputs to meet the entity's objectives.
COSO Internal Control Framework 2013 , COSO 2013 (underlies CC1 through CC5) 14 May 2013
Plain summary: COSO Internal Control Integrated Framework 2013 published by the Committee of Sponsoring Organizations of the Treadway Commission. Five components (Control Environment, Risk Assessment, Control Activities, Information and Communication, Monitoring Activities) supported by 17 principles. Underlies the SOC 2 Common Criteria CC1 through CC5.
COSO Internal Control Integrated Framework 2013 identifies five components of internal control that must be present and functioning: (1) Control Environment, (2) Risk Assessment, (3) Control Activities, (4) Information and Communication, (5) Monitoring Activities. Seventeen principles support the five components. The Trust Services Criteria Common Criteria CC1 through CC5 map directly onto these five components.
COSO GenAI Internal Control Guidance (Feb 2026) , Non-authoritative GenAI guidance mapped to COSO 2013 01 Feb 2026
Plain summary: COSO Generative AI internal-control guidance published February 2026. Non-authoritative. Maps the COSO 2013 framework onto generative AI use cases. Organises AI capabilities into 8 types (ingestion, transformation, posting, orchestration, judgment, monitoring, regulatory intelligence, human-AI interaction). Referenced in Module 8 emerging-controls lesson.
The February 2026 COSO Generative AI guidance is non-authoritative and does not amend the Trust Services Criteria. It maps AI use cases to the five COSO 2013 components and identifies 8 capability types: ingestion, transformation, posting, orchestration, judgment, monitoring, regulatory intelligence, human-AI interaction. As of 22 August 2026 AICPA has not issued authoritative AI-specific TSCs; practitioners should apply existing Common Criteria to AI systems in scope while monitoring AICPA for future guidance.
ISO/IEC 27001:2022 , ISO Information Security Management Systems standard 25 Oct 2022
Plain summary: ISO/IEC 27001:2022 International Standard for Information Security Management Systems. Common adjacent requirement for Indian SaaS. SOC 2 to ISO 27001 upgrade path covered in Module 8.
ISO/IEC 27001:2022 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of the organization. Annex A contains 93 controls organised across 4 themes (Organisational, People, Physical, Technological).
Freshworks Trust Portal , Freshworks security and SOC 2 posture (public) 01 Jan 2024
Plain summary: Freshworks Trust Portal covers SOC 2 Type II report availability, ISO 27001, GDPR, HIPAA postures. Referenced as case material for Module 8 Lesson 1 Trust Portal publishing pattern.
Freshworks maintains a public Trust Portal covering its SOC 2 Type II report, ISO 27001 certification, GDPR readiness, HIPAA readiness and other assurance postures. SOC 2 report distribution is NDA-gated via the Trust Portal.
Zoho Trust Page , Zoho security and compliance page (public) 01 Jan 2024
Plain summary: Zoho public security page covers SOC 2, ISO 27001, GDPR, DPDP Act, HIPAA and PCI DSS postures. Referenced as case material for Module 8 Lesson 1.
Zoho maintains a public security and compliance page covering its SOC 2 Type II, ISO 27001, GDPR, DPDP, HIPAA and PCI DSS postures. Detailed reports distributed on request under NDA.
Vanta SOC 2 platform , Vanta compliance automation platform 01 Jan 2018
Plain summary: Vanta SOC 2 compliance automation platform. Founded 2018, US-headquartered, active India presence. 2026 pricing: 6,000 to 10,000 USD per year for smaller startups on single-framework subscriptions, most startups landing in the 8,000 to 10,000 USD per year band; enterprise pricing quote-based. Referenced in Module 6 buy-vs-build decision lesson.
Vanta positions as a compliance automation platform covering SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS and others. Continuous evidence collection via cloud-provider integrations. Pricing per 2026 industry write-ups: smaller startups 6-8K USD per year; most startups 8-10K USD per year; enterprise quote-based.
Drata SOC 2 platform , Drata compliance automation platform 01 Jan 2020
Plain summary: Drata SOC 2 compliance automation platform. Founded 2020, US-headquartered. 2026 pricing: starts around 7,500 USD per year per framework. Auditor partnerships include Coalfire, A-LIGN, Prescient Assurance. Referenced in Module 6 buy-vs-build decision lesson.
Drata positions as an automated compliance and trust management platform. Pricing per 2026 industry write-ups: starting around 7,500 USD per year per framework, higher with additional frameworks. Auditor partnerships including Coalfire, A-LIGN, Prescient Assurance.
Secureframe SOC 2 platform , Secureframe (quote-only, US-focused) 01 Jan 2020
Plain summary: Secureframe SOC 2 compliance automation platform. US-headquartered, quote-only pricing model. Referenced in Module 6 buy-vs-build lesson for completeness.
Secureframe positions as an automated compliance platform covering SOC 2, ISO 27001, PCI DSS, HIPAA and others. Pricing is quote-only.
Sprinto SOC 2 platform , Sprinto (India-registered, DPDP-integrated) 01 Jan 2020
Plain summary: Sprinto SOC 2 compliance automation platform. Founded 2020, India-registered entity. INR pricing for domestic clients. DPDP Act 2023 workflows integrated. 2026 pricing: 6,000 USD per year single-framework startup plan; advanced plans 11,000-15,000 USD. Frequently recommended for Indian SaaS pursuing SOC 2 + DPDP simultaneously. Referenced in Module 6.
Sprinto positions specifically for Indian SaaS pursuing SOC 2, ISO 27001, HIPAA, GDPR and DPDP simultaneously. Pricing per 2026 write-ups: 6,000-10,000 USD per year for startup single-framework plans; 11,000-15,000 USD for advanced plans. Sprinto reports total first-year SOC 2 cost at 25,000-50,000 USD including audit, tooling and staff time; Indian CPA fees typically 30-50 percent lower than US equivalents.
Found an error? We pay for it.
If you find a factual error in any lesson, write to [email protected] with the lesson title, the specific claim, and the corrected source.
- ₹1,000 credit for the first report of any verifiable factual error.
- ₹5,000 credit for a substantial error (e.g. a wrong section number, an obsolete ruling, a misrepresented holding).
- Credit on your dcomply Academy account usable against any future course.
We pay because we'd rather know than not know. If the law changes (and it will), we want to be the first to fix our lessons.
On this page
- 🟢 Our verification promise
- 📊 Course statistics
- 📚 Full citation register
- 🐛 Bug bounty for errors
Maintained by the dcomply Academy editorial team. Last reviewed recently.