Tag
Audit Readiness, page 2
82 articles
Audit readiness
Screenshots vs system-generated evidence
When a screenshot is acceptable audit evidence, what it must show, why exports and system reports usually serve better, and how auditors test the reports.
6 min read
Compliance frameworks
Building an ISO 27001 risk treatment plan
What an ISO 27001 risk treatment plan must do, the fields each entry needs, how owner approval and residual risk acceptance work, and how to keep it live.
6 min read
Trust and sales
Security reviews for startups without a report yet
How a startup with no SOC 2 report can still pass a buyer's security review: what to offer instead, how to present the audit timeline, and what to avoid.
6 min read
Compliance frameworks
Choosing your SOC 2 Type II observation period
How to choose the length and dates of a SOC 2 Type II observation period: what each length allows, how control frequency limits it, and where to put the end.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Compliance frameworks
Writing an ISO 27001 scope statement
How to set ISO 27001 scope boundaries, write a scope statement your auditor and buyers can read, handle interfaces and dependencies, and avoid weak scopes.
6 min read
Compliance frameworks
HITRUST corrective action plans
When HITRUST requires a corrective action plan, what a good CAP contains, how to set dates you can meet, and how CAP progress is checked through the cycle.
6 min read
Compliance frameworks
QSA vs ISA: who assesses PCI DSS
A QSA assesses any organization; an ISA assesses only its own employer. What each role can sign, who decides which you need, and how to choose a QSA firm.
6 min read
Compliance frameworks
SOC 2 exceptions and qualified opinions: what they mean
What a SOC 2 exception is, how auditors decide whether it changes the opinion, the four opinion types, and how to respond when your own report has findings.
6 min read
Audit readiness
Continuous monitoring vs point-in-time audits
What an audit covers that monitoring cannot, what monitoring catches that an audit finds too late, and how auditors treat the output of your monitoring.
6 min read
Compliance frameworks
Accredited certification bodies and why accreditation matters
How accreditation of ISO 27001 certification bodies works, what it does and does not guarantee, how to verify a certificate, and how to choose a body.
6 min read
Compliance frameworks
Writing a POA&M that assessors accept
The fields a plan of action and milestones needs, how to write milestones an assessor believes, and what a POA&M cannot do under DoD scoring and CMMC.
6 min read
Audit readiness
What auditors actually ask for
Fieldwork is mostly a request list. Knowing the shape of that list in advance turns a stressful three weeks into a week of sending things you already have.
3 min read
Audit readiness
Running several audits on one calendar
How to fit SOC 2, ISO 27001 and PCI DSS into one year: each audit's fixed dates, aligning or staggering fieldwork, and annual controls that serve all three.
6 min read
Compliance frameworks
The ISO 27001 management review, done properly
What ISO 27001 clause 9.3 requires of a management review, who must take part, how to prepare each input, and what the record needs to show your auditor.
6 min read
Compliance frameworks
The HITRUST r2 interim assessment
What the HITRUST r2 interim assessment covers, when it falls, what your assessor tests, and how to keep year one of your certification from slipping.
6 min read
Compliance frameworks
The NIST 800-171 System Security Plan
What a NIST 800-171 system security plan must describe, a structure that works for assessors, and how to keep the plan accurate after the assessment.
6 min read
Audit readiness
Working well with your auditor
What your SOC 2 auditor or ISO certification body can and cannot help with, what to agree at kickoff, how to disagree with a finding, and what to ask after.
6 min read
Compliance frameworks
Running the ISO 27001 internal audit
What ISO 27001 clause 9.2 requires of an internal audit, who can perform it, how to build the audit program, and how to run one audit from plan to report.
6 min read
Audit readiness
What to do when a control fails mid-period
A control failed partway through your SOC 2 or ISO 27001 audit period. How to contain it, measure the extent, find the cause, and tell your auditor.
6 min read
Compliance frameworks
Building NIST CSF current and target profiles
How to build NIST CSF 2.0 current and target profiles: scoping, describing current practice with evidence, setting targets by risk, and planning gaps.
6 min read
Compliance frameworks
Network segmentation for PCI DSS
Segmentation is not a PCI DSS requirement, but without it your whole network is in scope. What counts as isolation, how to test it, and where it usually fails.
6 min read
Compliance frameworks
ISO 27001 surveillance audits: what to expect each year
What an ISO 27001 surveillance audit must cover, how the certification body samples across the three-year cycle, and how to run the year between audits.
6 min read
Compliance frameworks
Complementary user entity controls, explained
What complementary user entity controls are, why SOC 2 reports list them, how to write ones auditors and buyers accept, and what to do with a vendor's list.
6 min read