Jaclyn Finney

The requirement for cloud security audits for applications and infrastructure running within cloud environments has, at this point, become second nature to the industry. It is often a milestone needed to raise funding or in the expansion of clients. This article will define cloud compliance audits, outline the objectives and scope of a cloud audit, [...]

It is a misconception that the job of an auditor can be summed up to individuals that examine financial records with the goal of forming an opinion about the fairness of information presented within a company’s financial statements [...]

Across the globe, International Standards Organization (ISO) standards have been accepted by experts as a standard that can be relied upon for just about any process. They guide requirements to manufacture a good, provide a service, set up a management system, and comply with safety requirements. The list goes on and on. Since we are [...]

There are so many tools being released these days and for the most part, they aren’t cheap. But there is good news, the Cybersecurity & Infrastructure Security Agency (CISA) has assembled a group of free cybersecurity services and tools that most businesses can access. And no, you don’t have to be military affiliated. The goal [...]

The Privacy Rule protects most individually identifiable health information held or transmitted by a covered entity or its business associate in any form or media, whether electronic, paper or oral. [...]

SOC 2 considerations for software as a service (SaaS) providers can be a hard decision. On one hand, it has oftentimes become a contractual requirement but on the other hand, if that client or clients requesting the report do not provide enough revenue to offset that expense, the business case to move forward may not [...]

Vulnerability management, in general, is supported by the idea that once an organization identifies a vulnerability that exists within its environment, proper steps should be taken to remediate that vulnerability. Those steps include being prepared, knowing when to identify the vulnerability, analyzing the vulnerability, communicating information to the right individuals internal and external to the [...]

Internal controls (which include manual, IT-dependent manual, IT general, and application controls) are essential process steps that allow for one to determine or confirm whether certain requirements are being done per a certain expectation, law, or policy. Additionally, internal controls allow auditors to perform tests to gain assurance that a process is designed and operating [...]

Over the last year, the world saw a number of major security breaches in the news. Some notable ones include the SolarWinds attack, Colonial Pipeline Hack, and JBS U.S. Beef plant attack. Unfortunately, attacks are nothing new. Other major attacks over the years have included the Equifax data breach, Uber data breach, and WannaCry cyber [...]

Over the past few years, it seems like there is a new compliance framework that companies are required to follow every year. And many companies are trying to understand which one applies, how many they are required to obtain, and how much it is going to cost. This blog will discuss two frameworks: SOC 2 [...]