SOC 2

What Would My SOC 2 Dashboard Look Like?

October 25, 2019

As your organization pursues your SOC 2 certification, organization is critical.  You will be busy actively managing dozens of ongoing daily tasks, which can bury you in minutiae.  But at the same time, you need to keep your high-level compliance goals in focus in order to successfully move your certification over the finish line.  In this post, we will look

Read more
Brian Johnson
Security Engineer 7 Minute Security

Everything You Need to Know About SOC 2 Audits

October 22, 2019

Whether you’re looking to achieve SOC 2 compliance, or just want to learn more about it, your Googling is bound to lead you to a wealth of articles chock full of buzzwords and acronym soup. In this post, we will provide a guide with definitions, links and resources to gain a solid understanding of everything you need to know about

Read more
Brian Johnson
Security Engineer 7 Minute Security

The Definitive Guide to SOC 2 Policy Frameworks

October 17, 2019

If this is your first time pursuing SOC 2 certification, you will quickly find that documentation is the cornerstone of a successful audit.  Writing clear, concise policies is especially critical, and if you don’t currently have a policy structure in place, it can be difficult to figure out which policies you need.  In this post, we will help you get

Read more
Brian Johnson
Contributor

Physical Facility Access Policy Best Practices | A SOC 2 Primer

August 12, 2019

Physical security is not just a concern for large companies. A small business also needs an established physical security policy to protect their physical assets and provide their employees with a sense of protection and safety. In this policy, you will define the controls, monitoring, and removal of physical access to your company’s facilities. Here are five practices for writing

Read more

Implement a BYOD Policy | Best Practices for SOC 2 Compliance

August 8, 2019

Writing Your BYOD PolicyThis article will point you to the core concepts of BYOD, removable device, and cloud storage policies so that you understand best practices before writing your own. Removable media, cloud storage, and BYOD devices can be a quick and convenient way for employees to handle data.  But with this convenience comes some serious security concerns. Unprotected removable

Read more
Brian Johnson
Contributor

SOC 2 Terminology Glossary

July 3, 2019

SOC 2 compliance, like so many things related to IT and security, is chock full of terms and acronyms to learn.  If you are just getting started with SOC 2, it’s helpful to get familiar with this alphabet soup ahead of time so you can move your compliance efforts forward with confidence.  Below is a SOC 2 terminology glossary to

Read more
Brian Johnson
Contributor

Writing Your Security Incident Response Policy

June 27, 2019

This article will point you to the core concepts within the SIRP so that you understand the purpose of this policy before writing your own. The Security Incident Response Policy (SIRP) establishes that your organization has the necessary controls to detect security vulnerabilities and incidents, as well as the processes and procedures to resolve them.  The tricky thing about this

Read more
Brian Johnson
Contributor

Practical Tips to Improve Data Center Security and Compliance

March 26, 2019

In this post, we’ll answer the following questions:How do I know what rules and regulations I need to follow when protecting my data and data center? Where should I host my secure data center infrastructure (on-prem vs. colocation facilities vs. cloud vs. hybrid solution)? How do I plan for - and recover from - a physical data center failure?

Read more
Brian Johnson
Contributor

Log Management and Review Best Practices

February 25, 2019

When an information security incident occurs, you need to be able to gather as much information about it as quickly as possible. There’s also a very real possibility that you will have to involve outside parties - such as an incident response team - to help you as well. That means you can’t approach log management and retention as a simple checkbox. Instead, you need to have rich data that captures audit logs from all critical information systems. Otherwise, if your logs are incomplete, inaccurate or missing altogether, they won’t be of much help when you really need them.Here are five questions to ask when writing your log management and review security policy:

Read more