SOC 2 Academy: Evaluations of Internal Control

by Joseph Kirkpatrick / December 16, 2022

Common Criteria 4.1 When a service organization undergoes a SOC 2 audit, auditors will look to validate that they comply with the common criteria listed in the 2017 SOC 2 Trust Services Criteria. Common criteria 4.1 (CC4.1) states, “The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.” Why is it so important that organizations effectively perform evaluations…

SOC 2 Academy: Who Should Make Updates To Your Risk Assessment?

by Joseph Kirkpatrick / December 16, 2022

The Importance of Teamwork During a Risk Assessment During a SOC 2 audit, an auditor will assess an organization’s risk assessment processes. This includes not only assessing how the organization assesses risk, but the people involved in the risk assessment process as well. Auditors will want to see that the organization has a process in place regarding who should make updates to the risk assessment. Why is that? One of…

SOC 2 Academy: Assessing Changes Within Your Organization

by Joseph Kirkpatrick / December 16, 2022

Common Criteria 3.4 When a service organization undergoes a SOC 2 audit, auditors will look to validate that they comply with the common criteria listed in the 2017 SOC 2 Trust Services Criteria. Common criteria 3.4 (CC3.4) states, “The entity identifies and assesses changes that could significantly impact the system of internal control.” Let’s take a look at what organizations need to do during their SOC 2 audit to demonstrate…

7 Reasons Why You Need a Manual Penetration Test

by Sarah Harvey / December 16, 2022

Undergoing a penetration test can be a lengthy process. But pen testing - especially manual penetration testing - can save your organization hundreds of hours and thousands of dollars in the long run. Automated scanners can seem more cost-effective upfront, but they often don't cover the same depth of scope that manual security testing can. Here are 7 reasons why your organization should consider undergoing a manual security and penetration…

Getting the Most Out of Your Information Security and Cybersecurity Programs in 2019

by Sarah Harvey / June 15, 2023

As organizations plan their information security and cybersecurity efforts for 2019, we often hear a lot of confusion and frustration about things like frameworks modifying their requirements, the cost of audits and assessments rising, scopes getting bigger, and testing seeming to get more difficult. The threats will do nothing but persist in 2019. You need to do more to protect your organization. When prices or scope or frequency increases, here’s…