Home / Blog
Insights
IT Audit & Compliance Blog
Practical guidance written by the auditors who do the work.
Latest
Latest articles
-
SOC 2
What Is SOC 2 Compliance? Requirements, Reports & Audits Explained by a Veteran IT Auditor
SOC 2 is an attestation report, issued by an independent CPA firm, that tells your clients whether your controls over security are designed effectively and, for a Type 2, operate the way you say they operate over time.
By Rob PierceOctober 14, 2026 -
ISO
Information Security Risk Management: What the Frameworks Say & What Auditors Actually See
Information security's purpose is, or should be, to serve the business and help the company understand and manage its overall risk.
By John PohlmannOctober 7, 2026 -
Penetration Testing
Do I Need a Vulnerability Assessment Tool? If so, What's Best for My Organization?
The questions I often receive from my clients are whether they need a vulnerability scanning tool, what type of tool they should use based on the size of their company, and how often they should run scans.
By Helen ZellSeptember 30, 2026 -
AI & Emerging Risk
AI Made Compliance Cheaper. It Didn't Make Assurance Cheaper.
This is the short version: AI has brought compliance down to pennies a pop. It has not brought auditing down to pennies a pop.
By Richard RiebenSeptember 23, 2026 -
Compliance
Creating a Culture of Compliance: What It Really Looks Like & How to Build It
As companies grow and become subject to increasing regulatory scrutiny, one of the most valuable intangible assets that executives can foster is a culture of compliance.
By Tim NackosSeptember 16, 2026 -
SOC 1
What Is a SOC 1 Report? What Auditors Want You to Know Before You Start
A company was certain it needed a SOC 1 report. Ten minutes into the conversation, I asked the question I ask almost every time: can your service impact the financial statements of your clients?
By Rob PierceSeptember 9, 2026 -
CMMC & NIST
What Is a GSA Nonfederal CUI Assessment? What Contractors Need to Know Before It's Too Late
A GSA nonfederal Controlled Unclassified Information (CUI) assessment is an independent review of a contractor's system against the security and privacy requirements the GSA published.
By Mark LarsonSeptember 2, 2026 -
FedRAMP
FISMA Compliance Explained: What Federal Agencies & Contractors Need to Know
The Federal Information Security Management Act (FISMA) established the importance of information security principles and practices within the Federal Government.
By Ray DunhamAugust 26, 2026 -
HITRUST
HITRUST 2026 Trust Report: From Supply Chain Attacks to LLM Risks, What CSF v11.8.0 Means for Compliance
HITRUST publishes an annual Trust Report. 2026, however, has been a complex and revealing year for cybersecurity.
By Brian SandenawAugust 19, 2026 -
AI & Emerging Risk
CSA STAR for AI & ISO/IEC 42001: Which Should You Choose?
Companies that use AI as part of their daily practices, and customers of providers that use AI in their business model, are asking which assurance fits best.
By Lois ColbyAugust 12, 2026 -
AI & Emerging Risk
AI Regulatory Compliance in 2026: We Have Seen This Movie Before
No federal law regulates your use of artificial intelligence technology; a few states have binding requirements, and some apply even to organizations convinced they are exempt.
By Richard RiebenAugust 5, 2026 -
Compliance
What Is An Audit? An Auditor's Guide to What Actually Happens
Audits don't have to be intimidating. Learn what an audit is, the most common types, and what the process actually looks like from auditors who do this every day.
By Isaac ClarkeJuly 29, 2026 -
HIPAA
What is HIPAA Compliance? What Auditors Know That the Checklists Don't Tell You
There's no such thing as HIPAA certification, and that's just the start. Learn what HIPAA compliance actually requires, what OCR enforces, and what's changing.
By Rob PierceJuly 22, 2026 -
Compliance
Security Awareness Training Requirements: Who Needs It & What's at Risk
Not sure who needs security awareness training or what auditors expect? Learn who's included, the real risks of gaps, and how AI is changing the rules.
By Hilary StavrakasJuly 15, 2026 -
HIPAA
HIPAA Security Rule Requirements: What’s in Effect, What’s Changing, & What Are Auditors Seeing?
The HIPAA Security Rule faces its biggest proposed update in 20+ years. See what's required now, what's changing, and what auditors are already flagging.
By Danielle PeiJuly 8, 2026 -
Compliance
Don't be Caught Unawares: How to Preserve Audit Evidence when Decommissioning a System!
Decommissioning a system mid-audit cycle? Learn exactly what audit evidence to capture before it goes dark, from access controls to vendor reports and beyond.
By Helen ZellJune 24, 2026 -
Compliance
CCPA Cybersecurity Audit Requirements: What You Need to Know
CCPA cybersecurity audit rules took effect in 2026. Learn who's covered, what an independent auditor examines, and whether your program is in compliance.
By Kevin AndersonJune 17, 2026 -
HIPAA
The HIPAA Contingency Plan with a SOC 2 Spin
HIPAA contingency plan rules are changing in 2026. Learn what the five required components are, what auditors commonly find missing, and how to close the gaps.
By Umar AzizJune 10, 2026 -
SOC 2
SOC 2 Physical Security in a Remote-First World: What Auditors Actually Look For
Physical security doesn't disappear in a remote SOC 2: it shifts. Learn what moves to your cloud provider and what auditors still expect from you.
By Jessica KielJune 3, 2026 -
SOC 1
What Happened to SAS 70? Understanding SOC 1 Reports Today
SAS 70 is no longer used, but many vendors still reference it. Learn what replaced SAS 70, how SOC 1 reports work, and what to review in a vendor report.
By Maggie CheneyMay 20, 2026 -
HIPAA
SOC 2 vs. HIPAA Compliance: What Auditors See When Organizations Confuse the Two
SOC 2 and HIPAA often overlap, but they are not interchangeable. Learn when healthcare vendors may need both and where the biggest audit gaps appear.
By Megan KovashMay 13, 2026 -
SOC 2
What is Data Security? What SOC 2 Auditors Look For in Practice
Data security gaps are rarely obvious until an auditor finds them. Learn what SOC 2 auditors actually look for and how to close the gaps before they do.
By Becky McCartyMay 6, 2026 -
ISO
ISO/IEC 27001:2022 Clauses: Moving Beyond a Compliance Checklist
Struggling to move beyond a checklist? Learn how ISO 27001's mandatory clauses (4 to 10) build a resilient, audit-ready ISMS: with real-world examples.
By Rhonda WillertApril 29, 2026 -
HITRUST
The HITRUST® Readiness Assessment Guide
A readiness assessment is one of the first obstacles on the journey to HITRUST certification. This guide breaks down the entire process step-by-step for you.
By Richard RiebenApril 28, 2026 -
Penetration Testing
The 351-Day Risk Window: Why Annual Penetration Testing Isn't Enough
Annual pentests leave 351 days of untested exposure. Learn why point-in-time testing falls short, and what continuous pentesting actually changes.
By L&Co Staff AuditorsApril 22, 2026 -
AI & Emerging Risk
AI as Supply Chain Risk: What SOC 2 Auditors Need to Know Now
AI isn't just a tool; it's a supply chain risk. See how SOC 2 auditors evaluate AI dependencies, vendor gaps, and the controls that actually hold up.
By Ben BurkettApril 15, 2026 -
HIPAA
HIPAA Business Associate Agreements: Requirements, Risks, & What Auditors Actually Find
Learn what a HIPAA Business Associate Agreement (BAA) requires, who needs one, how AI tools factor in, and what auditors commonly find when reviewing BAA programs.
By John PohlmannApril 8, 2026 -
Compliance
What Is a Virtual CISO: and Does Your Organization Need One?
Can't afford a full-time CISO? A virtual CISO gives you elite security leadership, compliance expertise, and risk strategy, at a fraction of the cost.
By Fred MaldonadoApril 1, 2026 -
Compliance
Cloud Security Compliance Audits: Are You Audit Ready?
Failing a cloud security audit can block funding and lose clients. Learn what auditors look for, common pitfalls, and how to prepare before your next review.
By Jaclyn FinneyMarch 25, 2026 -
AI & Emerging Risk
Shadow AI & SOC 2: How Unauthorized AI Tool Adoption Creates Audit Gaps
Shadow AI could be quietly undermining your SOC 2 compliance. Learn how unauthorized AI tools create audit gaps and what auditors are looking for.
By Tim NackosMarch 18, 2026 -
CMMC & NIST
A Practical CMMC Compliance Guide for the Defense Industrial Base
Navigating CMMC compliance? Learn what's required at each level, what assessors actually check, and how to avoid the gaps that derail certifications.
By Mark LarsonMarch 11, 2026 -
Compliance
Federal Cloud Cybersecurity in Transition: What CSPs Must Understand Now
FedRAMP 20x, shifting DISA Impact Levels, and Zero Trust mandates are converging. Learn what the federal cloud security transition means for your CSP/CSO strategy.
By L&Co Staff AuditorsMarch 4, 2026 -
Compliance
Serving Two Masters: The Conflict of Interest Swallowing Accounting
Private equity is buying up accounting firms at a historic pace: and auditor independence is the price. Here's what the PE takeover means for public trust.
By Richard RiebenMarch 4, 2026 -
HITRUST
Trust vs. Verified Trust: Moving Beyond the SOC 2 Opinion with HITRUST
Is your SOC 2 report enough? Learn how HITRUST's Validated Trust model goes beyond attestation to deliver independently verified security assurance.
By Brian SandenawFebruary 25, 2026 -
ISO
Performing CSA-STAR Certification Audit in Conjunction with ISO/IEC 27001
Combining CSA STAR Level 2 with ISO 27001? Discover what you need to know about maturity scoring, CAIQ requirements, and integrated audit planning.
By Lois ColbyFebruary 18, 2026 -
SOC 2
The Commoditization of Trust: How the Assurance Industry is Selling Out
Not all SOC 2 audits are equal. Low-cost firms compromise rigor for speed, leaving organizations exposed. Here's why paying for quality protects your business.
By Richard RiebenFebruary 11, 2026 -
SOC 2
Mobile Security Threats: The Hidden Risk in Your SOC Readiness Preparation
From weak passwords to unsecured Wi-Fi, learn which mobile security threats our SOC 2 auditors consider in their reviews, and how to address them before your audit.
By Becky McCartyJanuary 28, 2026 -
HIPAA
HIPAA Compliance Audits: What Healthcare Organizations Need to Know
Worried about HIPAA audit readiness? Learn what triggers audits, how to prepare, and proven methods to demonstrate compliance that satisfy clients and regulators.
By Rob PierceJanuary 21, 2026 -
SOC 2
The SOC 2 Risk Assessment Criteria: Through the Eyes of an Auditor
Discover what auditors actually evaluate in SOC 2 risk assessments. Learn the 7 criteria, common failures, and how to align CC3, CC5, and CC9 effectively.
By Britney OswaldJanuary 14, 2026 -
Compliance
OS & Environment Hardening: Why System Security Matters & Key Considerations
Learn operating system and environment hardening steps, benefits, and auditor considerations. Reduce your attack surface with practical security guidance.
By Hilary StavrakasJanuary 7, 2026 -
ISO
ISO/IEC 27017: A Practical Guide to Cloud Security & Certification
Learn how ISO 27017 extends ISO 27001 for cloud security. Discover the 7 unique controls, certification roadmap, and how it compares to SOC 2 compliance.
By Rhonda WillertJanuary 7, 2026 -
Compliance
Mobile Device Management Guide: Work From Anywhere, Protect From Everywhere
Discover MDM best practices to secure your mobile workforce. Learn how mobile device management protects data, reduces risks, and supports BYOD programs.
By Danielle PeiDecember 17, 2025 -
Compliance
Audit Analytics: How to Use Data for Internal Audits & Why It’s Important
Learn the key benefits of audit data analytics for internal audit teams, plus practical guidance on overcoming common challenges, tools, and getting started.
By Tim NackosDecember 16, 2025 -
AI & Emerging Risk
Black Box Testing AI Systems: Processing Integrity in SOC 1 & SOC 2 Audits
Learn how auditors approach black box testing for AI systems in SOC 1 and SOC 2 audits. Discover essential controls for processing integrity and trust.
By Ben BurkettDecember 10, 2025 -
Compliance
User Access Reviews Best Practices: Fix Permission Risks Before Audits Find Them
Learn 8 user access review best practices to strengthen security, prevent privilege creep, and simplify compliance audits with this guidance from a SOC 2 auditor.
By Kevin AndersonDecember 3, 2025 -
SOC 2
Defense in Depth: What It Is & How It Relates to SOC 2 Compliance
Move beyond checklist compliance. Learn how defense in depth creates resilient, layered security that earns client trust and strengthens your SOC 2 audit readiness.
By Umar AzizNovember 19, 2025 -
Compliance
Audit Risk & the Audit Risk Model (ARM): An Auditor's Complete Guide
Learn about audit risk, the audit risk model (ARM), and how to reduce risk in SOC 1/SOC 2 audits. An auditor's guide to acceptable risk levels & planning.
By Maggie CheneyNovember 12, 2025 -
SOC 2
SOC 2 Compliance Checklist: Why it Doesn’t Exist (And What to Do Instead)
There's no official SOC 2 compliance checklist from AICPA. Learn why, and get practical guidance on readiness assessments, timelines, and audit prep.
By Megan KovashNovember 5, 2025 -
Compliance
Vendor vs Subservice Organizations: Understanding the Difference & How it Affects You
Guide to subservice organizations vs vendors and how they impact your SOC audit. Learn reporting methods, CSOC requirements, and vendor management best practices.
By Becky McCartyOctober 29, 2025 -
HITRUST
HIPAA Compliance in the Cloud - An Auditor’s Guide
Moving to the cloud doesn't make you HIPAA or HITRUST compliant, it changes how you prove it. Learn what auditors actually expect for healthcare SaaS compliance.
By Rob PierceOctober 22, 2025 -
ISO
What Is ISO/IEC 27006-1:2024 & What Changed in the 2024 (2025 Transition) Edition?
Auditor's breakdown of what changed in ISO/IEC 27006-1:2024 and how it impacts certification bodies and organizations. Learn about the 2025 transition timeline.
By Rhonda WillertOctober 15, 2025 -
Penetration Testing
Types of Penetration Tests: A Look at Different Pentest Techniques & Tools
There are a number of different types of penetration tests & tools. Here is guidance to help you determine which pentest you need for your organization & why.
By L&Co Staff AuditorsOctober 8, 2025 -
FedRAMP
A Guide to GovRAMP: An Overview For Your Authorization Journey
Learn how GovRAMP authorization helps CSPs secure cloud services for state & local governments, including compliance steps, requirements & authorization paths.
By Ray DunhamOctober 8, 2025 -
Compliance
IT Security Compliance in Hospitality: A Friendly Field Guide from the Lobby to the Server Room
Navigate PCI, SOC 2, and ISO compliance in hospitality with practical strategies from the front desk to the server room. Protect guest trust efficiently.
By John PohlmannOctober 1, 2025 -
Compliance
Risk Governance - What Is It & Where Do I Start?
Learn what risk governance is, how it fits into GRC programs, and the essential steps to establish effective risk oversight in your organization.
By Helen ZellSeptember 24, 2025 -
HITRUST
Expert Guide to the HITRUST Certification Process & Assessment Types
Master the HITRUST compliance and certification process with this detailed guide covering all assessment types, AI security requirements, costs, and timelines.
By Richard RiebenSeptember 24, 2025 -
SOC 2
IT Governance (GEIT) & SOC 2: Navigating Today's Complex Risk Landscape
Learn how IT governance (GEIT) and SOC 2 compliance work together to address emerging risks like AI, data ethics, and supply chain vulnerabilities.
By Fred MaldonadoSeptember 17, 2025 -
Compliance
What Do Auditors Do? Understanding an Auditor’s Responsibilities
What is an auditor and what do they do? Learn auditor responsibilities, types, required skills, professional guidelines, and key qualifications in this guide.
By Jaclyn FinneySeptember 10, 2025 -
Compliance
Navigating Audit Risk Assessment: Your Path to Compliance
Learn audit risk assessment fundamentals: three risk types, risk treatments, and best practices for SOC 2, HIPAA, and ISO 27001 compliance.
By Hilary StavrakasSeptember 3, 2025 -
FedRAMP
Are You Really FedRAMP Ready? What It Actually Takes
Think you're FedRAMP ready? Most companies underestimate what it takes. Learn the real requirements, costs, and pitfalls before you begin.
By L&Co Staff AuditorsAugust 27, 2025 -
ISO
ISO/IEC 27018: A Practical Guide to Cloud Privacy
Learn how ISO/IEC 27018 protects personal data in the cloud, how it is added to the scope of an ISO 27001 certification, and how it differs from ISO 27001.
By Rhonda WillertAugust 27, 2025 -
Compliance
Compliance Training - Insights & Guidance For Your Organization
Learn what compliance training is, why it's important, and best practices for implementation. Includes insights on programs, culture, and risk management.
By Tim NackosAugust 20, 2025 -
CMMC & NIST
NIST SP 800-61 Revision 3: Complete Guide to the New Incident Response Framework
NIST SP 800-61 Revision 3 replaces the 4-phase lifecycle with CSF 2.0 functions. Learn how to update your incident response plan for CMMC compliance.
By Mark LarsonAugust 13, 2025 -
HITRUST
The HITRUST ROI Report: Is HITRUST Certification Worth It? An External Assessor's Perspective
A Linford & Co external assessor analyzes HITRUST's ROI whitepaper. Learn the real value of HITRUST certification, benefits, and whether it's worth the investment.
By Brian SandenawAugust 6, 2025 -
PCI DSS
The New Era of PCI DSS 4.0: Requirements Effective After March 31, 2025
Learn PCI DSS 4.0's 47 mandatory requirements that are now in effect. Complete guide covering authentication, encryption, logging, and vulnerability management.
By Jenny ShenJuly 30, 2025 -
Compliance
Streamline Multi-Framework Compliance: One Audit, Many Certifications
Learn how to streamline multi-framework compliance with unified controls, AI mapping tools, and centralized evidence collection for SOC 2, ISO 27001, HIPAA, and more.
By Rob PierceJuly 23, 2025 -
Compliance
What Is an Unqualified Opinion Versus Other Report Opinions?
Learn what an unqualified audit opinion means for SOC 1 and SOC 2 reports, how it differs from qualified opinions, and why it's the gold standard.
By Lois ColbyJuly 16, 2025 -
Compliance
When, How, & Why To Use A Risk Matrix
What is a risk matrix? Why is it important for your organization? Here's guidance from an auditor on when, how, and why to use one - and how to create your own.
By Fred MaldonadoJuly 9, 2025 -
Compliance
Carve-Out vs Inclusive Audit Methods: Practical Guidance for Choosing the Right Approach
Learn when to use carve-out method vs inclusive method for subservice organizations in SOC 2 audits. Get practical guidance on choosing the right approach.
By Isaac ClarkeJune 25, 2025 -
Compliance
A Guide to Audit Management: Tools, Best Practices, & Process Stages
Complete audit management guide covering tools, best practices, and process stages. Learn how to streamline audits, reduce risk, and stay compliant.
By Jessica KielJune 25, 2025 -
ISO
ISO/IEC 27001 Risk Assessment: A Guide to Requirements, Methodology, & Best Practices
Learn how to conduct ISO 27001 risk assessments with step-by-step methodology, templates, and best practices for ISMS compliance and certification.
By Rhonda WillertJune 25, 2025 -
Compliance
IT Audits 101: Professional Guidance From an IT Auditor
Complete guide to IT audits and compliance. Learn the types, processes, benefits & best practices to protect your tech environment & meet standards.
By Umar AzizJune 18, 2025 -
PCI DSS
What is PCI Compliance?
Get auditor insights on PCI compliance. Learn what PCI DSS compliance means, including a breakdown of compliance levels, requirements, and how to achieve compliance.
By Becky McCartyJune 11, 2025 -
HITRUST
The HITRUST® Ecosystem: What the 2025 Trust Report Tells Us About Cybersecurity Maturity
Learn more about the HITRUST 2025 Trust Report findings: 99% breach-free certification rates, AI security initiatives, and cybersecurity maturity trends.
By Richard RiebenJune 11, 2025 -
Penetration Testing
Vulnerability Scanning: Importance of Vulnerability Scans in SOC 2 Audits
Learn what vulnerability scanning is, why it's critical for cybersecurity, and how to meet SOC 2 compliance requirements. Tools and best practices included.
By Britney OswaldJune 4, 2025 -
Compliance
Maintaining Access Control Post-Implementation: Guidance from an Auditor
Learn essential strategies for access control maintenance, including policy updates, user access reviews, and monitoring to ensure ongoing security effectiveness.
By Hilary StavrakasMay 21, 2025 -
SOC 2
Leveraging the Azure SOC 2 - How to Build a SOC 2 Compliant Product or Service
Learn how Azure SOC 2 compliance can simplify your audit process, reduce costs, and provide robust security controls with guidance from a seasoned SOC 2 auditor.
By Rob PierceMay 21, 2025 -
SOC 2
Leveraging the Google Cloud SOC 2: How to Build a SOC 2 Compliant SaaS
Learn how to inherit Google Cloud Platform's SOC 2 controls for your SaaS compliance. See which requirements GCP covers and how to properly document them.
By Rob PierceMay 21, 2025 -
FedRAMP
The FedRAMP 2025 Overhaul: Transforming Federal Cloud Security
Explore the FedRAMP 2025 overhaul through the new FedRAMP 20x initiative. Learn how four working groups are modernizing federal cloud security compliance.
By Ray DunhamMay 14, 2025 -
SOC 2
Mapping AWS Controls to Your SOC 2 Requirements: What You Need to Know
Learn to effectively map AWS controls to SOC 2 requirements. Understand the shared responsibility model and implement proper documentation for compliance.
By Danielle PeiMay 7, 2025 -
CMMC & NIST
Guide To Creating a CMMC Compliant System Security Plan (SSP)
Learn how to create a System Security Plan (SSP) for CMMC Level 2 certification, including scope determination, components, and maintenance best practices.
By Lois ColbyApril 30, 2025 -
SOC 2
Audit Sampling in SOC Examinations
Your guide to AICPA-aligned audit sampling methods, appropriate sample sizes, and best practices for effective control assessment in SOC 1 and SOC 2 audits.
By Nicole HemmerApril 23, 2025 -
SOC 2
SOC 2 Compliance and the Evolving Data Center Landscape
Becoming a compliant SOC 2 data center is an attainable goal, especially with guidance from an auditor to explain the process and who should be involved.
By John PohlmannApril 16, 2025 -
Compliance
Patch Management Process: A Guide for Implementation & Best Practices
Learn to implement an effective patch management process with our guide to covering vulnerabilities, testing, deployment, and overcoming common roadblocks.
By Jessica KielApril 9, 2025 -
SOC 2
SOC Audit Failure: Common Audit Mistakes to Avoid
Worried about SOC audit failure? Learn the most common SOC audit mistakes organizations make and practical strategies to prevent them in your compliance efforts.
By Maggie CheneyApril 2, 2025 -
SOC 2
Leveraging AWS SOC 2 Reports: Building a SOC 2 Compliant SaaS
Learn how to leverage the AWS SOC 2 report for SaaS compliance. Understand the shared responsibility model and the controls your company needs to implement.
By Rob PierceApril 2, 2025 -
SOC 1
SOC Review Guidance: Tips for Reading SOC 1 & SOC 2 Reports
Reviewing SOC 1 & SOC 2 reports can be confusing. Here is guidance on what you should look for, why it's important, & how the results impact your organization.
By Megan KovashMarch 26, 2025 -
ISO
Understanding ISO/IEC 27001:2022 Compliance
Learn to achieve ISO 27001:2022 compliance, and understand its key principles and benefits for enhancing your organization's information security management.
By Rhonda WillertMarch 19, 2025 -
AI & Emerging Risk
The Future of Personal Computing: Why PCs Will Be Obsolete by 2040
How will technology transform computing by 2040? We discuss the innovations poised to make traditional PCs obsolete and reshape our interaction with technology.
By L&Co Staff AuditorsMarch 12, 2025 -
AI & Emerging Risk
The Rise of AI Agents: Transforming Business & Auditing in the Digital Age
Discover how AI agents are revolutionizing business operations, the risks they introduce, and key considerations for auditors evaluating AI-driven processes.
By Ben BurkettMarch 5, 2025 -
AI & Emerging Risk
The Death of RPA: How Artificial Intelligence Has Taken the Lead
Why AI is replacing RPA in business automation? Learn how AI's adaptive capabilities and decision-making power deliver superior results compared to traditional RPA.
By Helen ZellFebruary 26, 2025 -
ISO
What is ISO? A Guide to Security Standards & Compliance
Learn about the ISO, how it shapes global security standards, and what you need to know about ISO compliance. Discover key benefits and steps for implementation.
By Jaclyn FinneyFebruary 12, 2025 -
SOC 2
SOC 2 Controls: Developing a SOC 2 Control List
Learn to identify and implement the right SOC 2 controls for your organization, including TSC guidance, points of focus, and practical examples.
By Kevin AndersonFebruary 5, 2025 -
Compliance
What is Containerization? A Security Implementation Guide
Learn what containerization is and how to secure container environments. Discover key security considerations, monitoring practices, and compliance requirements.
By Tim NackosJanuary 29, 2025 -
Compliance
Compliance Automation Tools: Can You Automate Regulatory Compliance?
Learn how compliance automation tools streamline regulatory compliance, their key benefits and risks, and how to choose the right solution for your organization.
By Rob PierceJanuary 22, 2025 -
CMMC & NIST
Stop Procrastinating: Your Guide to the CMMC Final Rule
Learn about the CMMC Final Rule effective December 2024, including key changes to CMMC 2.0, compliance requirements, and timeline for defense contractors.
By Mark LarsonJanuary 15, 2025 -
Compliance
CSA CCM: Cloud Security Alliance Cloud Controls Matrix - Overview & CSA Offerings
Cloud security is becoming exceedingly more prevalent in today's workforce. The CSA Cloud Controls Matrix is an excellent resource to help maintain security.
By Brian SandenawJanuary 8, 2025 -
HITRUST
HITRUST® AI Security Assessment & Certification: Assessing AI Systems
Learn about HITRUST's comprehensive AI Security Assessment & Certification. Protect your AI technologies, ensure compliance, and mitigate emerging security risks.
By Richard RiebenDecember 18, 2024 -
Compliance
What Does “Compliant” Mean in IT & Business?
Learn what business compliance means, key IT compliance standards, and how organizations can effectively meet regulatory requirements across industries.
By Nicole HemmerDecember 11, 2024 -
SOC 2
Emergency Changes: Mastering SOC 2 Compliance
Learn to manage emergency IT changes while maintaining SOC 2 compliance. Discover key strategies for handling critical system modifications safely and effectively.
By Jessica KielDecember 4, 2024 -
SOC 2
Audit Scope Considerations: Systems, Services, & Period Covered by Your SOC Assessment
Learn to effectively define your SOC audit scope with professional guidance on selecting systems, services, and time periods for comprehensive SOC assessments.
By Isaac ClarkeNovember 20, 2024 -
HIPAA
MARS-E: The Security Framework for Health Insurance Exchanges
Understand MARS-E security framework requirements & compliance standards for health insurance exchanges. Learn key controls & steps for protecting healthcare data.
By Umar AzizNovember 13, 2024 -
Compliance
Internal vs External Audit: What You Need To Know
Understand the key differences between internal and external audits, their purposes, and how both types strengthen organizational compliance and growth.
By Becky McCartyNovember 6, 2024 -
CMMC & NIST
Understanding the New NIST Password Guidelines for 2024
Explore the latest NIST password guidelines and their impact. Learn how to implement recommendations while maintaining security and improving user experience.
By Britney OswaldOctober 30, 2024 -
Compliance
What Are Intrusion Detection & Prevention Systems (IDPS) & How Do They Work?
Learn how IDPS (Intrusion Detection & Prevention Systems) work to protect your network. Discover the differences between IDS vss IPS components & their benefits.
By Hilary StavrakasOctober 23, 2024 -
Compliance
Software Supply Chain Security & the Secure Software Development Attestation Form
Introducing the Secure Software Development Attestation Form. Learn about SSDF Attestation, its purpose for software security, & how Linford & Co. can guide you.
By Richard RiebenOctober 16, 2024 -
Compliance
Role-Based Access Control (RBAC): A Key to Streamlined Access Management
Discover how RBAC enhances security and streamlines access management. Learn key components, best practices, and industry examples for effective implementation.
By Danielle PeiOctober 9, 2024 -
FedRAMP
FedRAMP Authorizations: New Paths & Looking to the Future
Explore new FedRAMP authorization options introduced by OMB M-24-15. Learn how these changes impact cloud service providers seeking federal government approval.
By Ray DunhamOctober 2, 2024 -
Compliance
AICPA Quality Management Standard (SQMS) No. 1 (and Why You Should Care)
Learn about the new AICPA Quality Management Standard (SQMS) No. 1, its importance for CPA firms, plus how it impacts attestation services like SOC 1 & SOC 2 reports.
By Lois ColbySeptember 25, 2024 -
PCI DSS
PII, PHI, PCI: Understanding the Differences for Compliance
Understand the key differences between PII, PHI, and PCI data. Learn how to protect sensitive information and ensure compliance with the latest regulations.
By Fred MaldonadoSeptember 18, 2024 -
Compliance
The Cloud Security Alliance (CSA) and the AICPA
What is the relationship between the CSA & the AICPA? Learn how CSA STAR standards overlap with SOC 2 reports to provide data protection in cloud computing environments.
By Megan KovashSeptember 11, 2024 -
Compliance
The Termination Process: Why Interdepartmental Collaboration is the Key to Success!
Interdepartmental collaboration is key for effective termination processes. We cover some common roadblocks and how to establish controls to enhance security.
By Helen ZellAugust 28, 2024 -
AI & Emerging Risk
ISO/IEC 42001:2023 & Its Influence on IT Security Assessments
Introducing ISO/IEC 42001:2023, the new AI governance standard. Learn how ISO 42001 enhances IT security audits, manages AI risk, and ensures ethical AI practices
By Ben BurkettAugust 21, 2024 -
Compliance
Disaster Recovery (DR) Testing: Getting the Most From Your Tabletop Exercise
Learn how to improve DR testing with enhanced tabletop exercises. Discover tips for realistic scenarios, thorough testing, and addressing business-wide impacts.
By Brian SandenawAugust 14, 2024 -
Compliance
What Is The Sarbanes-Oxley Act?
The Sarbanes-Oxley (SOX) Act mandates greater management responsibility and enhanced disclosure of fraud risk for public companies. Read for more details.
By Nicole HemmerAugust 13, 2024 -
Compliance
Continuous Monitoring Introduction
Continuous monitoring requires agility to adapt to dynamic threats. See how Linford & Co can help identify vulnerabilities before they’re exploited.
By Ray DunhamAugust 13, 2024 -
Compliance
CrowdStrike Outage: Lessons Learned in Controls & Resiliency
Learn from the CrowdStrike outage to enhance your organization's IT resilience. Discover key lessons in third-party risk, incident response, & cybersecurity controls.
By Maggie CheneyAugust 7, 2024 -
SOC 2
SOC 2 Vendor Management: Managing Key Vendors as Part of SOC 2 Compliance
Understand the importance of SOC 2 vendor management, key controls for compliance, and monitoring and responsibility allocation for effective vendor oversight.
By Nicole HemmerJuly 31, 2024 -
Compliance
Navigating Regulatory Compliance - An Auditor's Insights
Navigating regulatory compliance like HIPAA, GDPR, GLBA, and FISMA can be hard. Linford & Co. can help, with 16 years of expertise as certified auditors.
By Jenny ShenJuly 22, 2024 -
Compliance
Key Considerations for Implementing a Bring Your Own Device (BYOD) Program
These key considerations for implementing a BYOD policy at your company shed light on the risks and benefits. Let Linford & Co help your company thrive.
By Ben BurkettJuly 22, 2024 -
HIPAA
SaaS HIPAA Compliance Considerations & Certification
How can you get HIPAA compliance for SaaS? How can you identify HIPAA-compliant software? Our guide will answer your questions and more. Read on!
By Brian SandenawJuly 22, 2024 -
Compliance
Navigating the Risks of Patch Management: Security & Stability in IT Systems
Learn patch management risks and effective controls for IT security. Explore real-world consequences and best practices for maintaining secure, stable servers.
By Jessica KielJuly 17, 2024 -
Compliance
Smart Red Teaming with Game Theory & Threat Intelligence
Explore how Linford & Co's TIDE methodology uses Game Theory and MITRE ATT&CK to revolutionize red team engagements and strengthen organizational security postures.
By L&Co Staff AuditorsJuly 10, 2024 -
Compliance
Securing the CI/CD Pipeline: Essential Controls for Managing the Change Process
Enhance CI/CD pipeline security with essential controls. Learn how to fortify access, automate testing, monitor continuously, & prepare for incidents in development.
By John PohlmannJune 26, 2024 -
FedRAMP
What is FedRAMP Compliance? Requirements, Process, & More
Discover FedRAMP compliance and its impact on CSPs. Explore the documentation, assessment, and ongoing monitoring needed to achieve and uphold FedRAMP authorization.
By Ray DunhamJune 19, 2024 -
Compliance
CSA STAR Guide to Assessment, Attestation, & Certification
Explore the CSA STAR program, its framework, certification levels, the difference between attestation and certification, and the path to achieving compliance.
By Brian SandenawJune 12, 2024 -
Compliance
How Much Does CISA Cost? Good News - Tools Are Free!
Many businesses aren't aware of the free tools & resources available for use from CISA. We cover what's available to maintain your organization's cybersecurity.
By Jaclyn FinneyMay 29, 2024 -
SOC 2
SOC 2 Type 2 Reports - A Comprehensive Guide
What is a SOC 2 type 2 report? This comprehensive guide breaks down what you need to know for compliance and answers your most commonly asked questions.
By Kevin AndersonMay 22, 2024 -
SOC 2
SOC 3 Reports: Do You Need One?
The SOC 3 report is a general-use report after an attestation examination is conducted in accordance with the SSAE 18 standard. But who needs one?
By Lois ColbyMay 21, 2024 -
HIPAA
IT Risk Assessment and HIPAA Compliance
Get an IT Risk Assessment by the experts at Linford and Company, for greater HIPAA compliance and better protection against data breaches and OCR audits.
By Jenny ShenMay 20, 2024 -
HITRUST
HITRUST® vs HIPAA
Need help understanding the differences between HITRUST vs HIPAA? Read on to learn more about each, and which is relevant to your situation.
By Brian SandenawMay 17, 2024 -
Compliance
Observations from the XZ Utils Backdoor
Many people have questions about the recent Linux (almost) breach involving an XZ Utils backdoor. Here are 3 observations from an auditor to break it down.
By Tim NackosMay 15, 2024 -
SOC 2
Choosing a SOC 2 Audit Firm
Linford & Co knows how important it is to choose the right SOC 2 audit firm. Learn what to look for, questions to ask potential audit firms, and more.
By Nicole HemmerMay 13, 2024 -
CMMC & NIST
What Is the CMMC Assessment Process?
What is the CMMC assessment process? This is an auditor's breakdown of what it will look like and what to expect when preparing for a CMMC certification.
By Mark LarsonMay 8, 2024 -
HITRUST
Zero to HITRUST® (e1) Certified in 100 Days
Is HITRUST certification possible to achieve in 100 Days? We explain our process for the HITRUST e1 assessment, & how it can be possible for your organization.
By Brian SandenawMay 1, 2024 -
CMMC & NIST
What is the CMMC (2.0)? New DoD Guidance for Security Compliance
What is the CMMC? This in-depth guide provides clarity on cybersecurity model maturity certification, including recent updates that could affect your DoD contracts.
By Lois ColbyApril 24, 2024 -
Compliance
Identity and Access Management for Beginners
What is Identity & Access Management (IAM)? We cover why this system is critical to the security of your organization when it comes to managing & accessing data.
By Isaac ClarkeApril 17, 2024 -
AI & Emerging Risk
Risk Management in the Era of Large Language Models and Generative AI
Large Language Models & Generative-AI platforms are changing the landscape of business. We cover security concerns and how to effectively manage your risk.
By Richard RiebenApril 10, 2024 -
Compliance
Zero Trust Implementation - Guidelines & Best Practices
Implementing a zero trust security model doesn't have to be intimidating. This guide covers each step of the process and tools to help maintain compliance.
By Umar AzizApril 3, 2024 -
SOC 2
How the COSO Principles & SOC 2 Trust Services Criteria Align
Learn why aligning the Trust Services Criteria with COSO principles (2013) is a logical way to apply internal controls at an entity.
By Becky McCartyMarch 27, 2024 -
SOC 2
Cloud Patch Management Importance & Impact on SOC Reports
What is cloud patch management? This guide discusses how it can impact your organization and provides step-by-step guidance for SOC audit compliance.
By Britney OswaldMarch 20, 2024 -
HIPAA
HIPAA Business Associate vs. Covered Entity: Differences & Expectations
What is a covered entity and how does it differ from a HIPAA business associate? This breakdown explains who is and isn't covered, who needs them, and more.
By Hilary StavrakasMarch 13, 2024 -
Compliance
Audit Readiness: Professional Tips for a Successful Audit
This guide to audit readiness provides professional insights into how to best prepare for your organization's upcoming audit, and what to avoid.
By Danielle PeiMarch 6, 2024 -
SOC 2
Myth Busting 5 Common SOC Audit Misconceptions
This article breaks down the most common misconceptions we come across as auditors when clients are preparing for an upcoming SOC audit. Here are the facts.
By Ben BurkettFebruary 28, 2024 -
Penetration Testing
Which Types of Vulnerability Scanners Can Help Protect Your Company?
There are several different types of vulnerability scanners, so how do you decide which one (or more) is right for your organization? Here is guidance to help.
By Jessica KielFebruary 14, 2024 -
Compliance
Zero Trust Concepts & Audit Implications
What is Zero Trust? Here is our comprehensive guide on Zero Trust concepts and their critical role in enhancing audit processes and governance frameworks.
By Richard RiebenFebruary 7, 2024 -
SOC 2
Navigating SOC 2 Scope for a Successful Audit - Professional Insights
Confused about SOC 2 audit scope? These insights will help you understand how to tailor an audit scope to meet your security, compliance, and business needs.
By Megan KovashJanuary 24, 2024 -
ISO
ISO and Risk Management Frameworks for Supporting Enterprise Risk Assessments
This breakdown compares several risk management frameworks, including ISO 31000 - similarities, differences, benefits, & why it's critical to your organization.
By Rhonda WillertJanuary 17, 2024 -
Penetration Testing
Stop Pen Testing Like It’s Y2K - How to Implement Continuous Penetration Testing
This breakdown explains why implementing continuous penetration testing is more effective than the annual model, including benefits, cost, & why it's important.
By L&Co Staff AuditorsJanuary 10, 2024 -
Compliance
The Transforming Landscape of Vendor & Third-Party Risk Management
Here is a breakdown of the vendor & third-party risk management process - from guidance for sharing data to monitoring & best practices for your organization.
By John PohlmannJanuary 3, 2024 -
HIPAA
HIPAA Authorization: Requirements & Consent for Disclosing PHI
Covered entities, under the Privacy Rule, cannot disclose protected health information without patient consent. Learn about HIPAA Authorization Requirements.
By Jaclyn FinneyDecember 27, 2023 -
SOC 2
Pitfalls to Avoid When Transitioning From a Type I to a Type II SOC Report
Learn from the mistakes of others and avoid these 5 common pitfalls when transitioning your organization from a Type I to a Type II SOC Report.
By Kevin AndersonDecember 20, 2023 -
Compliance
Access Control Issues - Principles for Success & Avoiding Common Pitfalls
Issues with access control can directly impact the outcome of an audit. Here is professional insight on some common pitfalls to avoid & principles for success.
By Tim NackosDecember 13, 2023 -
Compliance
A Guide to Microsoft’s Supplier Security Privacy Assurance (SSPA) Program
This guide breaks down Microsoft's Supplier Security Privacy Assurance (SSPA) program - what it is, and the requirements for compliance and audit assurance.
By Mark LarsonNovember 29, 2023 -
HITRUST
A Guide to HITRUST® Interim Assessments
This guide explains the ins and outs of a HITRUST interim assessment - what it is, when it is needed, if one can be completed, the timeline, and what to expect.
By Brian SandenawNovember 22, 2023 -
SOC 1
Critical Audit Matters (CAMs) & SOC 1 Reports - Could They Be Related?
What are critical audit matters (CAMs) and how are they related to your SOC 1 report? Learn how an exception or qualification may be a contributing factor.
By Lois ColbyNovember 15, 2023 -
Compliance
Business Continuity vs. Disaster Recovery: The Building Blocks for Preparation
What is business continuity vs disaster recovery? We break down the differences between these recovery plans, as well as when & why they should be implemented.
By Hilary StavrakasOctober 11, 2023 -
HITRUST
What is HITRUST®? A Comprehensive Guide to HITRUST Assessments
What is HITRUST? Why is it important? This guide covers the benefits, requirements, who needs certification, how it compares to other frameworks, & more.
By Richard RiebenOctober 4, 2023 -
AI & Emerging Risk
Enhancing Your Company’s AI Security Policy - Professional Insights
As the use of AI continues to grow, it has become crucial to implement an AI security policy. Here are insights on what to consider and why it's important.
By Ben BurkettSeptember 27, 2023 -
ISO
ISO Certificate Verification: Considerations & Guidance
ISO certification is necessary for the standardization & quality assurance of an organization. This guide explains what to look for to verify its validity.
By Rhonda WillertSeptember 20, 2023 -
Compliance
Access Control Management - Guidance for Audit Compliance
What are access management controls & how do they affect your internal control environment? We cover types & examples of access controls, IAM tools, & benefits.
By Megan KovashSeptember 13, 2023 -
Compliance
What is Data Classification? Levels, Compliance, & Standards to Follow
When it comes to compliance, data classification is critical. This includes understanding how data should be maintained & protected within your organization.
By Maggie CheneyAugust 30, 2023 -
SOC 2
Business Continuity Planning: Why It’s Essential for Sustainable Success
What is a Business Continuity Plan (BCP)? From what it should include, to testing, to SOC 2 audit considerations, here's what you should know & why it's critical.
By John PohlmannAugust 23, 2023 -
Compliance
Understanding Audit Procedures: A Guide to Audit Methods & Test of Controls
Learn the 5 types of testing methods used during audit procedures for Type 2 SOC engagements, required to analyze service organization audit test of controls.
By Nicole HemmerAugust 9, 2023 -
SOC 2
Monitoring Controls at Subservice Organizations
What is the best way to monitor the effectiveness of controls used by your subservice organization for your SOC report? Here is helpful guidance from an auditor.
By Kevin AndersonJuly 19, 2023 -
AI & Emerging Risk
SOC 2 Audit Considerations for AI & ML Subservice Organizations
More & more subservice organizations are providing artificial intelligence & machine learning services. How are they audited? Here are SOC 2 considerations.
By Lois ColbyJuly 5, 2023 -
Compliance
The Link Between Risk & Controls - Guidance for Monitoring
What is the link between risk and controls, and how should your organization effectively monitor them? Here is guidance to map and mitigate those risks.
By Jessica KielJune 28, 2023 -
Compliance
New Cybersecurity Trends to Watch for in 2023 & Beyond
There's been a major influx of cyber attacks during the past year. Here are some of the top cybersecurity trends to look for in 2023 to keep your company safe.
By Mark LarsonJune 21, 2023 -
Compliance
What Is An Internal Auditor & Why Should You Hire One?
What is an internal auditor and why does your organization need one? Here is a breakdown of the expected roles, responsibilities, and required certifications.
By Isaac ClarkeJune 7, 2023 -
Compliance
What are the Benefits of Using VPN Encryption?
With remote work becoming more commonplace, data protection is a priority. Here are the benefits of VPN encryption, how they work, and why you should use one.
By Becky McCartyMay 17, 2023 -
Compliance
Assess, Remediate, & Prevent Audit Deficiencies - The Internal Control Deficiency Lifecycle
You are preparing for your SOC audit, and come across an audit deficiency...what do you do? Conduct an analysis to find, fix, and prevent audit deficiencies.
By Hilary StavrakasMay 10, 2023 -
SOC 2
SOC Report Benefits Beyond Compliance: The Value of SOC Reporting
When thinking of SOC report benefits, the first thing that comes to mind is compliance. Many overlook the additional value SOC audits offer to an organization.
By Ben BurkettMay 3, 2023 -
SOC 2
SOC for Supply Chain: Professional Guidance for Supply Chain Audits
Trying to decide if your organization should undergo a SOC for Supply Chain Report? Here is a breakdown of the process, & why supply chain auditing has value.
By Rhonda WillertApril 26, 2023 -
SOC 1
SOC 1 vs. SOC 2: How They Are Different & Which Report You Need
What are the differences between SOC 1 & SOC 2 audits? Here's guidance on controls, report types, compliance, & determining which report your organization needs.
By Nicole HemmerApril 5, 2023 -
Compliance
Audit Engagement Letters & Required Audit Terms: Tips for Preparation
What does your organization need to know about audit engagement, required audit terms, & executing an audit engagement letter? This guide will help you prepare.
By Maggie CheneyMarch 29, 2023 -
SOC 2
SOC 2 Considerations for SaaS Providers from an Audit Professional
Here's professional guidance on how SOC 2 audits affect SaaS providers - if and when you need a SOC 2 report and what criteria are needed to achieve compliance.
By Jaclyn FinneyMarch 15, 2023 -
HITRUST
Understanding the HITRUST CSF®: A Guide for Beginners
What is the HITRUST CSF? This in-depth guide explains why it's important, the different types of assessments, and how to implement it within your organization.
By Richard RiebenMarch 15, 2023 -
SOC 2
Understanding Information & Communication: Controls & Criteria for SOC 2
Here is professional guidance on the information & communication criteria & related controls that must be implemented in order to ensure SOC 2 audit compliance.
By Kevin AndersonMarch 8, 2023 -
SOC 2
Complementary Subservice Organization Controls (CSOCs), Cloud Considerations, & SOC Reports
What are Complementary Subservice Organization Controls (CSOCs)? An auditor explains how they impact your cloud environment and your upcoming SOC report.
By L&Co Staff AuditorsMarch 1, 2023 -
SOC 2
Trust Services Criteria (TSCs) for SOC 2 Reports
What are the AICPA Trust Services Criteria (f. Principles)? How do they relate to your SOC 2 audit? Here is recently updated guidance and what you should know.
By Lois ColbyFebruary 1, 2023 -
SOC 2
The SOC 2 Criteria for Monitoring Activities - Insights from an Auditor
What are the SOC 2 criteria for monitoring activities? We explain what monitoring activities are, why are they important, and how to achieve audit compliance.
By Isaac ClarkeJanuary 25, 2023 -
SOC 2
SOC 2 Audits for Small Businesses & Start-Ups: Tips for Preparedness
Running a small business is challenging enough - here are professional tips for SOC 2 audit readiness to achieve compliance without overburdening your team.
By Umar AzizJanuary 18, 2023 -
HITRUST
The Role of the HITRUST® Assessor: Your Trusted Partner
What is a HITRUST external assessor? Here is professional guidance on how they can help your organization, why you need one, & how to know they are qualified.
By Richard RiebenJanuary 11, 2023 -
Compliance
Security Maturity Models: Common Levels of Maturity & How They're Evaluated
What is a security maturity model and how does it benefit your organization? Here is a breakdown of the 5 levels of maturity and guidance for self-assessment.
By L&Co Staff AuditorsJanuary 4, 2023 -
HIPAA
SOC 2 in Healthcare: Why Do Soc Reports Matter for Audit Compliance?
Healthcare audits are obviously important. How do you know which ones you need? This breakdown explains why SOC 2 reports should be considered for compliance.
By Hilary StavrakasDecember 21, 2022 -
Compliance
Key AWS Monitoring Tools for Security & Audit Compliance - An Auditor's Perspective
AWS offers a number of tools and services to monitor the security of your cloud environment. Here is an auditor's breakdown of these tools and what they do.
By Ben BurkettDecember 14, 2022 -
SOC 2
SOC 2 vs SOC 3 Reports: What is the Difference?
What is the difference between SOC 2 and SOC 3 reports, and how do you know which one your organization needs? Here is professional guidance to help you decide.
By Megan KovashNovember 30, 2022 -
SOC 2
What is Operational Risk Management? Expert Guidance for Managing Risk
What is operational risk management (ORM)? Learn about the types of organizational risk, the benefits to your organization, and how it relates to SOC 2.
By Maggie CheneyNovember 16, 2022 -
HITRUST
What are HITRUST® Correction Action Plans (CAPs)? Answers to Common Questions
What is a HITRUST Correction Action Plan (aka CAP)? Here are some commonly asked questions on what you need to know, answered by a HITRUST External Assessor.
By Jenny ShenOctober 26, 2022 -
SOC 2
Data Retention Policy: What is it & How Does it Relate to a SOC 2?
What is a data retention policy & why is it important to your organization? Here is guidance for compliance & how it could affect your upcoming SOC 2 audit.
By Kevin AndersonSeptember 28, 2022 -
Compliance
What are the SEC’s Proposed Rules on Cybersecurity Risk Management?
In March 2022, the SEC proposed new rules to enhance & standardize cybersecurity risk management. Here's a closer look at how it will affect your organization.
By Mark LarsonSeptember 21, 2022 -
SOC 1
SSAE-21: New AICPA Guidance for Assertion-Based & Examination Engagements
In September of 2020, the AICPA came out with SSAE-21, which outlines new guidelines for assertion-based and examination engagements. Here is the breakdown.
By Lois ColbySeptember 14, 2022 -
Compliance
What is an Internal Audit? Answers to Common Questions
Learn the difference between an internal audit vs external audit, the types of internal audits, their process, standards, and value to your organization.
By Isaac ClarkeSeptember 7, 2022 -
Compliance
Considerations for Fraud Risk Assessment: COSO Principle 8
Learn how to properly assess your organization's fraud risk based on guidance from COSO Principle 8, including how to develop a fraud risk management program.
By Becky McCartyAugust 24, 2022 -
Compliance
Robotic Process Automation (RPA) Audit Process Guide & Impacts
What is Robotic Process Automation (RPA)? How does it impact the audit process? Here are the benefits, as well as guidance for implementation and compliance.
By Umar AzizAugust 24, 2022 -
Compliance
What is Audit Fatigue? How to Mitigate Common Stresses From Multiple Audits
What is audit fatigue & how could it affect your organization? Here is guidance for identification, prevention & mitigation to streamline compliance audits.
By L&Co Staff AuditorsAugust 10, 2022 -
PCI DSS
PCI and SOC 2 Audit Requirements: Combining PCI & SOC 2 Audits
PCI & SOC 2 audits do have some overlap, but can (should) they be performed together? Here's auditor insight to help you decide if or when they can be combined.
By L&Co Staff AuditorsJuly 20, 2022 -
Compliance
Enterprise Security: 5 Steps to Enhance Your Organization's Security
Enterprise security is the process by which an organization protects its information assets from infringement of confidentiality, integrity, or availability.
By Ray DunhamJuly 13, 2022 -
Compliance
Agile Auditing from an Insider’s Perspective
What is agile auditing & how does it impact your audit process? We cover how it works, its main objectives, benefits, challenges, & why you should consider it.
By Ben BurkettJuly 6, 2022 -
SOC 2
Static Code Analysis & Static Code Review: Are These Key SOC 2 Controls?
What are static code analyses and reviews? How do they differ, and how do they impact your organization? Here's what you should know for SOC 2 compliance.
By Rhonda WillertJune 29, 2022 -
SOC 2
Risk Evaluation & Mitigation Strategies for SOC 2 Compliance
Learn how to evaluate your organization's risk and implement appropriate strategies for mitigation and risk assessment in order to achieve SOC 2 compliance.
By Megan KovashJune 22, 2022 -
SOC 2
AICPA FAQs on SOC 2 Automation Tools: Insights from an Auditor
Many organizations may be tempted to rely solely on SOC 2 automation tools - here is a breakdown of the AICPA FAQs whitepaper to discuss the risks & benefits.
By Rob PierceJune 15, 2022 -
CMMC & NIST
Understanding the NIST Privacy Framework: Insights from an Auditor
What is the NIST Privacy Framework and what do you need to know to create one for your organization? Here is guidance on mapping and more from an auditor.
By Maggie CheneyJune 8, 2022 -
Penetration Testing
Vulnerability Management Maturity Model, Procedures, Threats, & More
What is the vulnerability management maturity model? Here is auditor insight into how it affects vulnerability management, procedures, life cycles, and more.
By Jaclyn FinneyJune 1, 2022 -
HITRUST
How to Score HITRUST CSF® Controls
How are controls scored in HITRUST assessments and how do those scores ultimately drive the HITRUST rating? Here is a guide to scoring HITRUST CSF controls.
By Richard RiebenMay 22, 2022 -
SOC 2
Board of Directors - Is One Required For a SOC 2 Audit?
How do you know if you need a board of directors for your company, and for SOC 2 audit compliance? Here are insights from an auditor on what you need to know.
By Kevin AndersonMay 18, 2022 -
Compliance
Corrective Action Plans 101: Guide for Managing Audit Findings
What is a corrective action plan? Here's professional guidance on the purpose, process, how to create a plan to manage audit findings, and achieve compliance.
By Jenny ShenMay 11, 2022 -
SOC 2
Cyber Threat Intelligence - What It Is & How It Relates to SOC 2 Audits
What is cyber threat intelligence? We break down the goals of CTI, how the process works, benefits, cost, and how it relates to your upcoming SOC 2 audit.
By Mark LarsonMay 4, 2022 -
SOC 1
Audit Trails for the SOC 1/SOC 2 Audit & Investigative Processes
What are audit trails? Learn more about how they are critical to the everyday operations of your organization, as well as documentation for the audit process.
By Lois ColbyApril 27, 2022 -
Compliance
Control Objectives & Activities: What Are They & What’s Appropriate?
Get a better understanding of control objectives, controls, and control activities, as well as how to identify and draft appropriate control objectives.
By Isaac ClarkeApril 20, 2022 -
Compliance
Insider Threats in Cyber Security: Risks They Pose & How to Mitigate Them
Find examples of insider threats in cybersecurity, along with insights on mitigation and risks, to help organizations understand the risk management process.
By Ray DunhamMarch 30, 2022 -
Compliance
What is Incident Management & Why is It Important?
What is incident management? Here is guidance to help you understand the benefits, processes, and some tips for implementing your own incident response plan.
By Becky McCartyMarch 23, 2022 -
SOC 2
Data Migrations & Their Impact on a SOC 2 Report
What is a data migration? How does it impact your upcoming SOC 2 audit? Here is professional guidance to help your organization through the migration process.
By Hilary StavrakasMarch 16, 2022 -
SOC 2
Blockchain Audits - Why Does Your Blockchain Need a SOC Audit?
Do blockchain companies need SOC reports? Here is professional guidance to help you understand the benefits of auditing blockchain, what it is, & how it works.
By Ben BurkettMarch 2, 2022 -
Compliance
Preventive Controls & Their Importance To the Security Control Environment
What are preventive controls (aka preventative controls)? Here is guidance to help you understand how they affect the security of your control environment.
By Rhonda WillertFebruary 23, 2022 -
SOC 2
What Are Bridge (aka Gap) Letters & How Do They Relate to SOC Reports?
What are bridge (aka gap) letters? Find answers to questions on how they relate to SOC Reports - including requirements, coverage period, examples, & templates
By Megan KovashFebruary 16, 2022 -
Compliance
Information Security Governance: Guidance for IT Compliance Frameworks
What is Information Security Governance, and how does it benefit you? Here is guidance to create a unified IT compliance framework within your organization.
By Maggie CheneyFebruary 2, 2022 -
Compliance
What Are Internal Controls? The 4 Main Types of Controls in Audits (with Examples)
What are Internal Controls? Learn the types of controls: how they work, their purpose, importance, examples & how they protect your service organization.
By Jaclyn FinneyJanuary 25, 2022 -
SOC 2
What is a Security Operations Center (SOC) & Why Should You Invest in One?
What is a Security Operations Center and could it affect your organization? Here's a breakdown of how they work, what the benefits are, and why to invest in one.
By Jenny ShenJanuary 5, 2022 -
SOC 2
SOC 2 Software Tools: How They Affect the SOC Audit Process
The use of SOC 2 software compliance tools is growing, but are they reliable? How do they work? Here's auditor insight to help you understand what you should know.
By Lois ColbyDecember 22, 2021 -
SOC 2
Are You Asking for a SOC Report? Do You Need One? When It's Required
How do you know if your company needs a service organization control (SOC) report? Is it required? If your customers are asking for it, you will need one.
By Isaac ClarkeDecember 15, 2021 -
Compliance
IT Change Management for Service Organizations: Process, Risks, Controls, Audits
What's IT change management & how does it affect your service organization? Here's guidance for the entire process, including risks, controls, & best practices.
By Becky McCartyDecember 1, 2021 -
SOC 1
Risks of Blockchain on Service Organization Control (SOC) Assessments
As service organizations embrace blockchain technology, it is necessary to understand the risks to your organization, and how they affect SOC assessments.
By Ben BurkettNovember 17, 2021 -
SOC 2
What is Section 5 of the SOC 2? The Unaudited Section of a SOC Report
Section 5 of a SOC 2 report is also known as the "unaudited section." Here's guidance to help you understand what information your organization should include.
By Hilary StavrakasNovember 10, 2021 -
Compliance
Client Acceptance: Procedures and Auditor Considerations for Approval
What is client acceptance? How could it potentially affect your organization? Here are insights from an auditor on the client acceptance process & procedures.
By Rhonda WillertNovember 3, 2021 -
SOC 2
SOC Incident Reporting: What are SOC 2 Security Reporting Requirements?
Cyber attacks are on the rise. As a result, it's imperative that your organization has proper guidance for SOC cybersecurity incidents & reporting requirements.
By Jaclyn FinneyOctober 13, 2021 -
SOC 2
Security & Privacy: You Can’t Have Privacy Without Security
How do security & privacy controls overlap in terms of your organizational compliance? Here's a guide to understanding why you can't have one without the other.
By Lois ColbySeptember 15, 2021 -
SOC 2
Securely Sharing SOC Reports: Answers to Common Questions
Here are answers to some of the most common questions we hear from service organizations about the proper way to safely and securely distribute SOC reports.
By Isaac ClarkeSeptember 8, 2021 -
SOC 2
Understanding the Entity & Its Environment: Why It’s Important For SOC 2
What does it mean to obtain an understanding of the entity & its environment? What is an entity & how do your controls affect the environment in terms of SOC 2?
By Hilary StavrakasAugust 4, 2021 -
SOC 1
Inclusive Audit Method: How Does This Method Change a SOC 1 or SOC 2 Report?
What is the Inclusive Audit Method, and how does it affect your SOC 1 or SOC 2 report? Here is expert inclusive audit guidance to ensure SOC 1 & 2 compliance.
By Rhonda WillertJuly 28, 2021 -
SOC 2
Inherent Risk vs Control Risk: Audit Risk for SOC 2 Reports
What is the difference between inherent risk vs control risk in terms of a SOC 2 report, and what controls should be implemented in order to mitigate your risk?
By Megan KovashJuly 21, 2021 -
CMMC & NIST
What is the NIST Cybersecurity Framework & How Does SOC 2 Map to It?
Here is expert guidance on how to use the NIST CSF to implement a cybersecurity framework that maps to the SOC 2 Criteria and supports your audit compliance.
By Maggie CheneyJuly 14, 2021 -
HITRUST
Navigating Compliance Frameworks: SOC 2 vs. HITRUST®
Determining whether your company needs a SOC 2 report or a HITRUST certification generally depends on a number of different variables. What are the differences?
By Jaclyn FinneyJuly 7, 2021 -
Penetration Testing
Vulnerability Assessment vs Penetration Testing for SOC 2 Audits
What is the difference between a vulnerability assessment vs penetration testing? Should you consider performing both & how does it relate to a SOC 2 audit?
By Mark LarsonJune 23, 2021 -
Penetration Testing
External Penetration Testing & SOC 2 Reports: How Are They Related?
What is external penetration testing (aka pentesting) and why is it important? How do they affect SOC 2 reports? How are they related? What you need to know.
By Lois ColbyJune 16, 2021 -
SOC 1
International Standards for SOC 1 & SOC 2: ISAE 3000 & ISAE 3402
Is your service organization compliant with both U.S. & international attestation standards? How do SOC 1 & 2, ISAE 3402 & 3000, & AICPA standards work together?
By Isaac ClarkeJune 9, 2021 -
Compliance
Choosing an Auditor: How Do I Find a Good, Better, Best Auditor?
Choosing an external auditor for your upcoming audit engagement might seem daunting, but it doesn't have to be. Here is guidance to help you find the right fit.
By Ben BurkettMay 12, 2021 -
SOC 2
IUC & IPE Audit Procedures: What is Required for a SOC Examination?
What are IPE & IUC? Are they relevant to your SOC audit? This breakdown defines the completeness & accuracy of test procedures to strive for full compliance.
By Rhonda WillertApril 28, 2021 -
SOC 2
SOC Readiness Assessments: Recommended Guidance for Audit Readiness
SOC readiness assessments are the perfect way to get an idea of how you will perform in your upcoming SOC audit and recommendations for any necessary fixes.
By Nicole HemmerApril 14, 2021 -
Compliance
AICPA Peer Reviews - Who Audits the Auditor?
Organizations regularly undergo various types of audits...but who audits the auditors? Here is a breakdown of AICPA peer reviews and industry standards.
By Jaclyn FinneyApril 7, 2021 -
SOC 2
How to Simplify SOC 2 Compliance with AWS Security Tools
What AWS security tools are available to ensure that you are SOC 2 compliant? Here is an in-depth look at the security tools offered by AWS, and how they work.
By Richard RiebenMarch 31, 2021 -
Compliance
The MITRE ATT&CK Framework: How Does MITRE ATT&CK Work?
What is the MITRE ATT&CK Framework? How does it work? Here we discuss the extensive framework used to help identify hacker tactics, behavior, & more.
By Mark LarsonMarch 24, 2021 -
Compliance
Entity-Level Controls: Impact On An Organization & The Audit Process
What exactly are entity-level controls, & what do they have to do with the assessment of your organization? Here is a breakdown to help you understand.
By Lois ColbyMarch 17, 2021 -
SOC 2
What are Description Criteria for a SOC 2 Report?
What are description criteria? How are they relevant to your upcoming SOC 2 audit? This guide explains what you need to know about SOC 2 description criteria
By Becky McCartyFebruary 24, 2021 -
Compliance
Why Is Having An Internal Audit Plan Critical To An Effective Audit?
Preparing for an audit can be daunting. Here are insights to guide you through the steps of internal audit planning & why it is important for your organization.
By Jessica KielFebruary 17, 2021 -
SOC 2
How Bad is a Qualified Audit Report? Understanding SOC Report Opinions
A qualified audit report is not the worst-case scenario in a SOC report, but a service organization should strive to obtain an unqualified opinion. Learn more.
By Megan KovashJanuary 27, 2021 -
SOC 1
Management Responsibility in an Audit - Who Does What in a SOC Audit?
What is management responsibility in an audit? Here's professional insight into the difference between management vs auditor responsibilities during SOC audits.
By Maggie CheneyJanuary 20, 2021 -
Compliance
Defining Suitable Criteria in an Audit Engagement
Not every audit is the same, and not all audit criteria are equal. How do you define what suitable criteria should be evaluated for your assurance engagement?
By Lois ColbyDecember 16, 2020 -
SOC 2
What is an Assertion? How Audit Assertions Relate to SOC Reports
Audit assertions are claims made by members of management regarding aspects of a business. Learn how auditors incorporate them into SOC reports for a business.
By Isaac ClarkeDecember 9, 2020 -
SOC 2
SOC Report Types: Understanding SOC Audits and the Differences Between a Type 1 vs Type 2 SOC Report
Learn the difference between SOC report types, specifically Type 1 vs Type 2 SOC reports or audits. Why should your organization choose one over the other?
By Becky McCartyNovember 18, 2020 -
SOC 2
Reasonable Assurance: What is It & How Does It Affect SOC Report Opinions?
What is reasonable assurance in relation to your upcoming SOC audit? Is absolute assurance possible? We will explain how to understand the auditor's opinion.
By Megan KovashNovember 4, 2020 -
SOC 2
SOC Audit Report Overview: The Definitive Guide
If you run an organization, you may be considering a SOC audit. But which one do you need and why? This thorough guide explains everything you should know.
By Nicole HemmerOctober 22, 2020 -
Compliance
Materiality in Auditing: How to Prepare For Your Audit
What is materiality and how does it relate to your upcoming attestation? This article will help you to understand the process of materiality in auditing
By Jaclyn FinneyOctober 14, 2020 -
Compliance
What is Endpoint Security? Why is it Important?
What is endpoint security? How does it work? Here are some endpoint protection best practices and industry recommendations for securing your data.
By Mark LarsonSeptember 30, 2020 -
Compliance
A Guide to Audit Assurance: How Do Assurance, Attestation, and Auditing Fit Together?
What is audit assurance, and how does it differ from attestation or an audit? This guide will help you understand the nuances before your assurance engagement.
By Lois ColbySeptember 23, 2020 -
Compliance
Security Awareness Training: Implementing End-User Information Security Awareness Training
Learn the importance of security awareness training and find training options and resources to help improve your cybersecurity and protect your company’s data
By Jaclyn FinneyAugust 5, 2020 -
Compliance
Why Encryption is Necessary: A Perspective on Compliance and Effectiveness
Data encryption involves many moving parts for an organization to maintain security. Is encryption alone enough, or should you consider more protection?
By Terry DalbyJuly 29, 2020 -
Compliance
Security Compliance: Understanding the Difference Between Security Vs. Compliance
Security compliance is an ongoing process. Here is a guide to help you understand the difference between security and compliance to better protect your company
By Mark LarsonJuly 22, 2020 -
Compliance
Detective Controls & Their Impact on the Overall Control Structure
What are detective controls? How do detective and preventive controls work? Here is a guide to help understand how these controls protect your organization.
By Lois ColbyJuly 15, 2020 -
HITRUST
SOC 2 + HITRUST®: How Your Organization Could Benefit From Both
You may be wondering which assessment is best for your organization...but should you be considering SOC 2 plus HITRUST? Here is what you need to know.
By Isaac ClarkeJuly 8, 2020 -
HIPAA
De-Identification of Personal Information: What is It & What You Should Know
De-identification of personal information is a complicated subject that can cause issues if not handled appropriately. Here's a guide to maintaining compliance
By L&Co Staff AuditorsJuly 1, 2020 -
CMMC & NIST
DFARS Compliance: What You Need to Know
What is DFARS, and how do you know if you need to be in DFARS compliance? Here is an in-depth guide that explains all the details you should be aware of.
By Ray DunhamJune 24, 2020 -
Compliance
Understanding the Limitations of Internal Controls - Learning to Mitigate Your Risk
What are "inherent limitations" of internal controls, and how could they affect your company? Advice on what to look for, and preventative measures to take.
By Maggie CheneyJune 3, 2020 -
SOC 2
Risk of Material Misstatement - Audit Risk Components Related to SOC Reports
What is the risk of material misstatement, and how could it affect your service organization? Here is a guide to help you navigate the audit process.
By Jaclyn FinneyMay 20, 2020 -
SOC 2
SOC Report Testing: Testing the Design vs. Operating Effectiveness of Internal Controls
What is the difference between design effectiveness vs operating effectiveness? How could it affect your company's audit? Here is what you need to know.
By L&Co Staff AuditorsMay 13, 2020 -
Compliance
Information Security Policies: Why They Are Important To Your Organization
An information security policy is a vital component for protecting company data, and more. Read here to learn all about the importance of information security.
By Ray DunhamMay 6, 2020 -
Compliance
How to Choose a VPN When Working from Home: Data Safety Considerations for Coronavirus
Remote work is on the rise and protecting client data is increasingly important. This guide will help you learn about VPNs, and how to choose the right one.
By Megan KovashApril 22, 2020 -
Compliance
Maintaining Optimal Cybersecurity with Remote Staff Working from Home During Coronavirus Outbreak
Coronavirus has caused a major shift to a remote workforce. Here are some recommendations to ensure your work data stays secure while working from home.
By Nicole HemmerApril 8, 2020 -
Compliance
Establishing an Effective Internal Control Environment
Learn how your organization can benefit from an internal control environment and risk assessment aligned with industry best practices, laws, and regulations
By Isaac ClarkeMarch 25, 2020 -
HIPAA
HIPAA Gap Analysis: Critical & Recent Compliance Gaps You Need to Know
Recent violations of HIPAA laws have cost organizations millions in settlements. Here is an overview of those cases, and how to avoid becoming one of them.
By Becky McCartyMarch 4, 2020 -
FedRAMP
An Expert Guide to a FedRAMP Readiness Assessment
A FedRAMP Readiness Assessment is an opportunity for Cloud Service Providers (CSP) targeting government clients to gain advantage in the marketplace.
By Ray DunhamJanuary 15, 2020 -
Compliance
What Is Attestation?
Attestation engagements help companies gain assurance over an extensive amount of topics, other than historical financial statements. Learn more.
By Jaclyn FinneyDecember 11, 2019 -
HIPAA
What is the Scope of HIPAA Compliance?
For Business Associates, HIPAA compliance is primary focused on the HIPAA security and breach notification rules. Learn about the scope of HIPAA compliance.
By L&Co Staff AuditorsNovember 20, 2019 -
Compliance
Data Encryption: Use It or Lose It (Your Data)
Learn what data encryption is, how it works, why it’s important, what data should be encrypted, and where encryption should be used.
By Ray DunhamNovember 13, 2019 -
SOC 2
SOC 2 Privacy vs. GDPR: Personal Data Audit Considerations & Compliance
Learn about similarities and differences between SOC 2 Privacy and GDPR during audits for compliance with personal data security regulations.
By Becky McCartyNovember 6, 2019 -
HIPAA
HIPAA Risk Assessment: Security Compliance vs Risk Analysis: What is the Difference?
Learn whether your organization is meeting all of the HIPAA security requirements via a risk analysis (risk assessment).
By L&Co Staff AuditorsSeptember 25, 2019 -
Compliance
Logging and Monitoring - An Essential Part of Every Security Program
Logging and monitoring has a special organizational role to support and provide insight into all the other key areas of a security program. Learn more.
By Ray DunhamSeptember 18, 2019 -
PCI DSS
SOC 2 vs PCI DSS: What’s the Difference?
PCI is specific to businesses that accept credit card payments/ SOC 2 covers a broader range of organizations that hold, store and/or process customer data.
By Megan KovashSeptember 4, 2019 -
Compliance
What is an Integrated Audit? Assessing Internal Controls
An integrated audit combines a financial statement audit with an audit of internal controls. Let us help your company comply with the Sarbanes-Oxley Act.
By Jaclyn FinneyAugust 21, 2019 -
Compliance
What is the PCAOB? Auditing Standards & Inspection Reports
The Public Company Accounting Oversight Board (PCAOB) is a critical safeguard to ensuring that auditing standards of inspection reports are upheld.
By Isaac ClarkeAugust 14, 2019 -
HIPAA
2019 HIPAA Wall of Shame: Recent Security Breaches & Examples for Companies to Learn From
Find information about 2019 HIPAA security breaches, recent examples, and what you can learn and do to prevent them.
By L&Co Staff AuditorsJuly 31, 2019 -
SOC 2
The SOC 2 Privacy Audit
A Privacy Audit helps companies to ensure proper data protection and provide confidence to customers that you’re protecting their personal information.
By Becky McCartyJuly 17, 2019 -
Compliance
Chaos Engineering: What is it? Should You Use it?
Chaos Engineering can provide great benefit to organizations who utilizes a distributed architecture, comprised of microservices. Learn more!
By Jaclyn FinneyJuly 3, 2019 -
Compliance
What are the Roles and Responsibilities of Information Security?
Learn to structure your information security team by outlining roles and responsibilities based on organizational size, structure and business processes.
By L&Co Staff AuditorsJune 19, 2019 -
Compliance
What is Upstream and Downstream Testing in Auditing?
Learn about downstream/upstream testing services and the "right people/right access" concept in the context of a Physical Access testing.
By Nicole HemmerMay 15, 2019 -
FedRAMP
FedRAMP 3PAOs: What is Their Role in the FedRAMP Process?
A FedRAMP 3PAO is an independent firm that specializes in performing security assessments of commercial CSPs and save them time and money. Learn how!
By Ray DunhamApril 17, 2019 -
SOC 2
Understanding SOC Services: Organization Control Audits
SOC services can be confusing, notably when you're unsure of the difference between the services, and what is right for your organization. We break it down!
By Megan KovashApril 3, 2019 -
SOC 1
SOC Certifications: Are SOC 1 & SOC 2 Audits Actually Certifications?
There is no such thing as a SOC 1 certification, SOC 2 certification, SSAE 16 certification, or SSAE 18 certification. Know the facts about what you are getting.
By Nicole HemmerMarch 27, 2019 -
Compliance
Understanding Blockchain: Security, Risks & Auditing Tips
Understanding the blockchain security, risks, and how auditing can assist in determining whether platforms are secure. Learn more.
By Jaclyn FinneyMarch 20, 2019 -
SOC 1
There is No SOC 1 Audit Checklist...Only Questions & Considerations
Some firms will provide you with a standard, one-size-fits-all SOC 1 audit checklist. However, there is no such list. Learn what you need to know.
By Isaac ClarkeMarch 13, 2019 -
FedRAMP
What is FedRAMP? 5 Considerations Before Taking the Leap
FedRAMP is a government program designed to bring consistent and repeatable processes to security evaluations of cloud service offerings (CSO) for the federal government.
By Ray DunhamFebruary 27, 2019 -
SOC 2
Who Can Perform a SOC Audit?
If a SOC 1 or SOC 2 report is not completed by a CPA firm, the report should not be relied upon. Learn why.
By Jaclyn FinneyJanuary 30, 2019 -
Compliance
Testing & Audit Exceptions
Learn the purpose and process of an audit, what audit exceptions are, and get clarification of what to look for when discussing SOC audit results.
By Isaac ClarkeJanuary 23, 2019 -
FedRAMP
FedRAMP vs. FISMA: What You Need To Know
Both FedRAMP and FISMA aim to reduce information security risk within federal information systems. Learn their key differences and similarities.
By Ray DunhamJanuary 9, 2019 -
HIPAA
Breach Notification Rule: Requirements for HIPAA & SOC 2
Learn what is required from a company perspective with breach notifications for HIPAA and SOC 2, so that proper escalation procedures can occur.
By Jaclyn FinneyDecember 5, 2018 -
ISO
What Is ISO 9000?
ISO 9000 is a principle-based international standard that describes a quality management system to be more efficient and improve customer satisfaction.
By Isaac ClarkeOctober 3, 2018 -
Compliance
Considering Risk to Mitigate Cyber Security Threats to Online Business Applications
Learn the principles of security and privacy, terms used to complete risk assessments and what it means to use a risk-based approach to security framework.
By Jaclyn FinneySeptember 5, 2018 -
Compliance
Understanding an Audit Letter of Representation (LOR)
An audit letter of representation is prepared by a service auditor and signed by company management, attesting to the accuracy and completeness of the audit
By Isaac ClarkeAugust 29, 2018 -
Compliance
What is Cryptojacking and How to Protect Yourself
Although cryptojacking is less damaging than most cyber attacks, it’s still serious. The delivery mechanisms and code will continue to evolve. Stay informed!
By Ray DunhamAugust 1, 2018 -
SOC 2
SOC 2 Security Trust Services Criteria
The Security TSC is the only TSC that is required in a SOC 2 audit, and refers to the protection of information and systems. Learn more.
By Nicole HemmerJuly 18, 2018 -
Compliance
GDPR Compliance Checklist: Key Tasks for Organizations to Complete
If your organization transmits, receives, processes, or stores data relating to EU citizens, you are impacted by the GDPR. Our compliance checklist will help.
By Ray DunhamJune 6, 2018 -
SOC 2
Confidentiality Trust Services Criteria in a SOC 2
Learn why the “Confidentiality” criteria is an important TSC for service organizations that need to demonstrate how they keep client data confidential.
By Nicole HemmerMay 30, 2018 -
SOC 2
Availability Trust Services Criteria in a SOC 2 Audit
In this post we will look specifically at the availability trust service criteria as part of a SOC 2 audit, which is important for service organizations who need to demonstrate their ability to have their systems available to clients at all times.
By Nicole HemmerApril 18, 2018 -
SOC 2
Complementary User Entity Controls, Considerations, & SOC Reports
A SOC report for any service organization must be evaluated along with any applicable Complementary User Entity Controls at the user entity. If CUECs do not operate effectively at a user entity, control failures could occur related to the use of a particular service organization. Learn more.
By Rob PierceMarch 28, 2018 -
Compliance
Security Procedures - How Do They Fit Into My Overall Security Documentation Library?
Go beyond security policies and understand the importance of security procedures, how they fit into your overall security documentation library, and find principles to keep in mind of when drafting your security procedures.
By Ray DunhamMarch 14, 2018 -
SOC 2
Confidentiality vs. Privacy in a SOC 2
Learn the key differences between the privacy and confidentiality TSCs in a SOC 2 examination. It depends on the type of data a service organization has in their possession and what they are doing with it that will determine which (or both) TSC should be included in the examination.
By Nicole HemmerMarch 7, 2018 -
Compliance
Cloud Services Agreements: Protecting Your Hosted Environment
Moving your company’s data and hosted environment to the cloud can feel like a major loss of control, but it doesn’t have to. Learn how to create a detailed Cloud Service Agreement that outlines your company requirements, confidentiality, and more to protect your company information.
By Jaclyn FinneyFebruary 28, 2018 -
SOC 2
SOC Qualified Opinions & What they Mean for Your Organization
SOC report qualifications are fairly common. They relate to an area of the report that an auditor finds exceptions related to. If the exceptions are severe enough in a particular area the auditor may provide a qualified opinion related to the area with issues. Learn more.
By Rob PierceFebruary 14, 2018 -
FedRAMP
The FedRAMP SSP: Important Tips for a Successful Outcome
The FedRAMP System Security Plan (SSP) is the foundational document that supports a FedRAMP assessment. A poorly written SSP or one that excludes important control implementations will only delay the assessment process and cost the CSP valuable time and resources. Learn how to make yours a success!
By Ray DunhamJanuary 31, 2018 -
Compliance
Corporate Data Backup: What’s the Point?
Data has increasingly become an important facet to the success of companies, hence the need for a formalized corporate data backup plan. Gain an understanding the foundations of a backup plan, rules to follow and get an outline that can be used in this documentation process.
By Jaclyn FinneyJanuary 17, 2018 -
SOC 2
How Long Does a SOC Examination Take?
Every service organization is different, and the average time taken for a SOC examination depends on whether it’s a Type I or Type II SOC examination.
By Nicole HemmerDecember 13, 2017 -
FedRAMP
FedRAMP Continuous Monitoring - What Are the Responsibilities of CSPs and 3PAOs?
Learn the specific FedRAMP continuous monitoring requirements and some things to keep in mind when preparing to address these requirements.
By Ray DunhamSeptember 27, 2017 -
Compliance
The 10 Generally Accepted Privacy Principles
With a global economy driven by a digital industry, GAPP privacy principles provide a comprehensive framework for organizations to manage their privacy risks.
By Isaac ClarkeSeptember 13, 2017 -
SOC 2
What is Processing Integrity and Who Needs it in their SOC 2?
Learn the importance of processing integrity for detecting errors in processing, input/output accuracy, data storage, and maintenance.
By Nicole HemmerAugust 23, 2017 -
HIPAA
HIPAA Record Retention Requirements: How Long Should We Retain ePHI Data?
Learn HIPAA record retention requirements and ensure that your organization is retaining ePHI and PHI according to your state’s requirements.
By Rob PierceAugust 2, 2017 -
Compliance
Can You Assess & Manage Your Organizational Risk?
Find simple steps (from a professional auditor) that can help your organization effectively and efficiently assess and manage its risks.
By Isaac ClarkeJuly 19, 2017 -
Compliance
Is the Cloud Safe?
The cloud can be just as safe as a physical environment such as a standard data center as long as the proper controls are in place to safeguard information.
By Jaclyn FinneyJuly 12, 2017 -
SOC 2
Reporting on an Entity’s Cybersecurity Risk Management Program and Controls (SOC for Cybersecurity)
Learn about the AICPA’s new cybersecurity risk management reporting framework that is being added to the suite of SOC report offerings.
By Nicole HemmerJune 28, 2017 -
Compliance
Climbing to the Top: Understanding Major Cloud Service Providers
Find examples of major cloud service providers, deployment models used by CSPs, and tips to identify a cloud service provider.
By Jaclyn FinneyMay 17, 2017 -
CMMC & NIST
What is a Third Party Administrator (TPA) Audit?
An independent TPA audit offers assurance regarding the TPA’s internal control environment, and may include detailed tests of claims, irregularities, etc.
By Rob PierceApril 14, 2017 -
Compliance
How Is Your (Cyber) Hygiene?
When most people think of hygiene, I would venture to say that technology or computer systems are not part of the mental picture. There are interesting parallels, however, between what we think of as “normal” hygiene and cyber hygiene.
By Ray DunhamFebruary 21, 2017 -
SOC 2
What Period Is Covered In A Type II SOC Examination?
A Type II SOC 1 (f. SSAE 16) or SOC 2 report (versus a Type I) usually covers a 12 month period, but can be as short as six months. Learn more.
By Nicole HemmerJanuary 10, 2017 -
Compliance
What Is COBIT®?
COBIT® stands for Control Objectives for Information and Related Technology. What is it? Put simply, it is a framework for enterprise wide governance to include business functions, information and information technology resources. The COBIT® framework provides a structure upon which to build an enterprise governance program.
By Ray DunhamSeptember 6, 2016 -
Compliance
Data Analytics as an Audit Tool
Data analytics is defined as the process of inspecting, cleaning, transforming, and modeling data with the goal of highlighting useful information, suggest
By Rob PierceMarch 15, 2012
No articles match. Try another topic or search the whole site.
Not finding it? Search the whole site for
Our authors
Written by our partners
Rhonda WillertPartnerCPA, CISSP, CISA, PMP, QSA, ISO 27001 Lead Auditor
Rob PiercePartnerCISSP, CISA, CCSFP, CHQP
John PohlmannPartnerCISA
Richard RiebenPartnerCISSP, CCSFP, CHQP, GSNA, QSA, CySA+, SecurityX, CCA, CCP
Tim NackosPartnerCPA, CISA, ISO 27001 Senior Lead Auditor
Mark LarsonPartnerCISSP, CISA, QSA, Lead CCA, CCP, ISO 27001 Lead Auditor
Ray DunhamPartnerCISSP, CISA, GSEC, GWAPT
Lois ColbyPartnerCPA, CIA, CISA, CCSK, Lead CCA, ISO 42001 Lead Auditor, ISO 27001 Lead Auditor
Get in touch
Have a question an article didn't answer? Talk to a partner.
Get straightforward answers from experienced auditors.