Tag
Audit Readiness, page 3
82 articles
Audit readiness
Fixing gaps before the observation period starts
How to sort readiness gaps by type, decide which must close before a SOC 2 Type II period starts, prove each fix works, and pick a start date you can hold.
6 min read
Compliance frameworks
Writing the SOC 2 system description
What the SOC 2 system description must contain under the AICPA's DC 200 criteria, how auditors test it, and how to write one that stays accurate.
6 min read
Compliance frameworks
ISO 27001 stage 1 vs stage 2 audits
What the certification body examines in an ISO 27001 stage 1 and stage 2 audit, how the two stages differ, what happens between them, and how to prepare.
6 min read
Audit readiness
First-audit mistakes, and how to avoid them
The mistakes that make a first SOC 2 or ISO 27001 audit slower and messier: aspirational policies, unknown populations, ignored vendors and the draft report.
6 min read
Compliance frameworks
What an ISO 27701 certification audit involves
How an ISO 27701 certification audit runs: choosing a certification body, stage 1 and stage 2, what gets sampled, nonconformities, and surveillance.
6 min read
Compliance frameworks
How to scope your first SOC 2 report
The seven scoping decisions for a first SOC 2: services, system boundaries, categories, report type, vendors, and customer duties, agreed before the audit.
6 min read
Compliance frameworks
Moving from ISO 27001:2013 to the 2022 edition
The ISO 27001:2013 transition period is over. What changed in the clauses and Annex A, where 2013 leftovers hide in an ISMS, and how to check for them.
6 min read
Audit readiness
The PBC list: handling auditor requests
How to run an audit request list: triage, a tracker with the right fields, file naming, quality checks before you send, and keeping sensitive data out.
6 min read
Compliance frameworks
How to write a Statement of Applicability
What ISO 27001 requires in a Statement of Applicability, the columns worth adding, how to justify inclusions and exclusions, and how to keep it current.
6 min read
Risk and vendors
Risk treatment options: mitigate, transfer, accept or avoid
What each of the four risk treatment options really commits you to, the evidence each leaves, why transfer never moves accountability, and when to mix.
6 min read
Compliance frameworks
Writing control implementation statements
How to write NIST 800-53 implementation statements an assessor can test: cover every part and parameter, name the mechanism, and handle inherited controls.
6 min read
Audit readiness
Preparing control owners for auditor interviews
Who auditors interview, the questions control owners and staff are asked, a one-page briefing for each owner, and the line between preparing and coaching.
6 min read
Compliance frameworks
HITRUST maturity scoring in the r2 assessment
How the r2 scores each requirement across policy, procedure, implemented, measured and managed, what evidence moves a score, and where effort pays off.
6 min read
Compliance frameworks
Reducing your PCI DSS scope
Every in-scope system must meet every applicable PCI DSS requirement. How scope works, the options that shrink it, and the ones that only look like they do.
6 min read
Compliance frameworks
SOC 2 processing integrity: who needs it and why
Which services should include processing integrity in a SOC 2, how its five criteria turn into controls on inputs, processing, and outputs, and what it costs.
6 min read
AI governance
ISO 42001 Annex A controls explained
The nine ISO/IEC 42001 Annex A control areas: what each covers, the evidence an auditor samples, which ones are new work, and how to justify an exclusion.
6 min read
Compliance frameworks
The ISO 27001:2022 Annex A themes, explained
How the 93 Annex A controls in ISO 27001:2022 are grouped into four themes, which 11 controls are new, and how ISO 27002 attributes let you sort them.
5 min read
Compliance frameworks
SOC 2 Type I vs Type II: what actually differs
Type I reports on design at a point in time. Type II reports on operation over a window. That single difference changes scoping, evidence and your timeline.
3 min read
Audit readiness
What happens in an audit walkthrough
What an auditor does in a control walkthrough, what they are testing, what to have open on screen, and the mistakes that turn a one-hour session into three.
6 min read
Compliance frameworks
ISO 27001 clause 6: risk assessment and treatment
What ISO 27001 clause 6.1 requires of your risk assessment and treatment process, step by step, the records it must leave, and where auditors find gaps.
6 min read
Audit readiness
How auditors sample controls
How SOC 2 auditors set sample sizes, select items from your population and handle a failed sample, and how ISO 27001 certification audits sample instead.
6 min read
Compliance frameworks
Preparing for a HITRUST validated assessment
The steps before HITRUST fieldwork: fixing scope, choosing an assessor, running a readiness assessment, building evidence, and what happens at QA.
6 min read
Compliance frameworks
Choosing the right PCI DSS self-assessment questionnaire
Which PCI DSS self-assessment questionnaire fits depends on how you take card payments, not your size. The SAQ types, their eligibility tests, and the traps.
6 min read
Compliance frameworks
Should you include availability in your SOC 2?
How to decide whether availability belongs in your SOC 2: what it adds beyond security, the commitments that trigger it, and the evidence auditors will test.
6 min read