ISO 27001 FAQs – Information Security Management for Your Organization

by Sarah Harvey / April 26, 2023

What is an ISO 27001 Audit? ISO 27001 is the only internationally-accepted standard for governing an organization’s information security management system (ISMS), created by the International Organization for Standardization (ISO). ISO is an independent, non-governmental international organization with a membership of 161 national standards bodies. It brings together experts to share knowledge and develop voluntary, consensus-based, market relevant international standards that support innovation and provide solutions to global challenges. The…

How to Hire a CPA Firm for Information Security Audits

by Sarah Harvey / June 14, 2023

What Type of CPA Firm is Right for You? Before choosing an audit firm to work with, you must understand why, for some types of audits, you need a CPA firm to perform the services. Clients and prospects ask us all the time why accountants are allowed to perform information security audits. We understand the confusion behind this sentiment and want to provide some clarity. The AICPA’s SOC suite –…

Hackers vs. Consumers: 6 Best Practices for Safe Online Holiday Shopping

by Sarah Harvey / June 14, 2023

Best Practices for Safe Online Holiday Shopping While businesses are gearing up for the busiest shopping season of the year and consumers are anxiously awaiting the best online deals, malicious hackers will be prepping to get their hands on valuables as well. This makes it increasingly important that consumers practice due diligence while online shopping. Clicking on random links, buying products from unsecure websites, and inputting personally identifiable information where…

Risk Assessment Checklist – 5 Steps You Need to Know

by Sarah Harvey / April 12, 2023

What is a Risk Assessment? A risk assessment is a process by which an organization analyzes vulnerabilities, potential threats and risks to the organization's security posture and IT systems. Performing a risk assessment is a critical component of any Information Security program. Because it’s mandated by several frameworks (SOC 1, SOC 2, PCI DSS, ISO 27001, HIPAA, FISMA), organizations wanting to comply with these frameworks must conduct risk assessments on…

business people walking

SOC 2 Academy: A Board’s Independence from Management

by Joseph Kirkpatrick / December 16, 2022

Common Criteria 1.2 When a service organization undergoes a SOC 2 audit, auditors will be looking to validate that they comply with the common criteria listed in the 2017 SOC 2 Trust Services Criteria. Common criteria 1.2 states, “The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.” Let’s take a look at how boards of directors can demonstrate independence from…