SOC-2 Signatory Made Easy

Soc 2 esigning

[Music] hi this is Jason within DnB and I'm here to provide helpful tips and recommendations for ensuring you have an efficient problem-free sock to audit from start to finish at nd MB we're often asked to describe the auditing process specifically what exactly is sock - what deliverables can clients be expected to provide how long does the audit process take what challenges and roadblocks often surface and much more these are all valid topics so I'd like to take this time to discuss these items and many more in greater detail the more you understand the sock - auditing process and everything that goes with it the better prepared your organization will be so let's get started let's start off with an understanding of what a sock to audit is sock stands for system and organization controls a comprehensive framework put forth by the American Institute of Certified Public Accountants the AICPA for examining an organization's internal controls or simply stated it's a framework that is extensively used for examining a business's security and operational policies procedures processes and best practices with any sock to audit it's important to understand the following measures documentation is essential to the sock to auditing process when we use the word documentation we're talking about the formalized processes and procedures that need to be documented within your operational and information security policies and procedures so ask yourself the following question do we as an organization have comprehensive InfoSec policies and procedures in place material that covers areas such as access control data backup change management instant response and data retention and much more if you don't you'll need to develop them so keep something in mind while companies are traditionally very good at what they do they unfortunately lack the documentation in describing their InfoSec and operational best practices this can create a big gap in sauk to reporting it's why we offer a comprehensive set of sock - policy templates for helping our clients save time and money you may very well have documentation in place but is it accurate current and doesn't meet the need of sock 2 reporting usually the answer is no but again you can develop these documents very quickly with our sock 2 policy templates let's talk about a number of key operational procedures that must be performed each year for a sock to audit there are four key operational procedures let's start with the first one conduct an annual risk assessment there's really a fair amount of flexibility as to what constitutes a risk assessment so to make things easy we provide clients with a comprehensive easy-to-use risk assessment template program number to perform annual security awareness training security awareness training is a strict mandate for Sauk to compliance so you want to make sure you have a program in place for training employees on today's emerging security issues threats concerns and best practices in DnB provides clients with a comprehensive easy to use security awareness training program template number three performed vulnerability scans on a regular basis another strict mandate for Sauk to compliance is performing vulnerability scanning on a regular basis you'll need to essentially determine what IP target hosts are in scope and then scan the addresses on a regular basis which should be once a month as a best practice number four implement if you haven't already done so and test annually your instant response plan once you've implemented an instant response plan you'll need to test it each year and document the test results so keep something in mind all businesses will have some form of remediation to perform no business has a picture perfect control environment there's always something to improve upon so be prepared to spend time remediating gaps and deficiencies prior to the audit how little or how much remediation needs to be performed ultimately depends on the maturity of your control so what we have found historically speaking is that businesses will need to spend time enhancing their policies and procedures along with implementing any number of key operational procedures and activities that we just spoke about earlier also you need to know that Sauk to audits are about obtaining evidence and odd it wouldn't be not it if we didn't collect evidence validating your controls with that said here are the four main areas of audit evidence you'll be providing to us as part of the Sauk to auditing process number one documentation so no surprise here as we've spoken about the importance of InfoSec policies and procedures number two memos many times it's actually best for our clients to describe a certain process or procedure and when that's the case a document is signed memo works great a large part of Sauk to deliverables will in fact request memos for audit evidence number three screenshots so a significant part of Sauk to auditing encompasses security controls so expect to provide a wide range of screenshots relating to antivirus settings log reports network configurations password complexity rules and much more number four operational evidence as mentioned earlier you'll need to perform a risk assessment before I'm security we're training conduct volna Billy scans test your instant response plane and more and then provide that type of evidence to us the auditors so the key says successful audit well number one remediate your policies and procedures riding InfoSec policies and procedures is time-consuming but it's important however we also provide you the sock to policy packet which should help you out tremendously number two implement operational procedures right after your policies and procedures have been successfully completed you'll need to ensure all the previously mentioned operational procedures are in place remember risk assessment security awareness training vulnerability scanning and testing your instant response plan number three communicate with your auditors look having an open channel of communication with us is imperative the overall success of your audit number four understand that compliance is not a start and stop process you need to be ensuring that you are monitoring your internal controls regularly this is process known as continuing monitoring so next steps by now you should hopefully have a solid understanding of all aspects of the sock to audit process now's the time to log in to your personal URL and begin reviewing all the tests of controls and deliverables remember sock to compliance is highly dependent upon organizations having documented policies and procedures in place so remember to begin by assessing your current status of your InfoSec policies the quicker you complete this very essential step of the auditing process the greater the chances of an overall efficient auditing process we're here to help so at any time if you have any questions please feel free to reach out to us