SANS put together a great overview of SOC 2 terminology, report structure breakdown, and process in their signature cheat sheet format. This is a great document to keep handy if you are an auditor, executive, sales person, or whomever that may have to come in contact with a SOC 2 at some point in time.
This is slightly outdated as of the Fall 2022 refresh of the SOC 2 but still a very handy item!
SOC Reporting Guide
SOC 2 – CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes,
User access reviews are a critical control in almost any IT control framework because they help ensure that users have the appropriate level of access to sensitive data and systems.
The System and Organization Controls (SOC) 2 Report will be performed in accordance with AT-C 205 (formerly under AT-101) and based upon the Trust Services Principles, with the ability to
Some organizations have heard of SAS 70, SSAE 16, and now SSAE 18, but, haven’t seen the value, other than because one of their customer require it. Truth is, that’s
I’ve been hearing from various people in the marketplace that they were interested in learning about some steps, at a high level, that they need to take to get off