SOC 2 and ISO 27001 Part 2 – How to Get your Reports and Certification 

by | Dec 2, 2021 | Security

How to obtain a SOC 2 report

  1. Pick your trust criteria that your organization will achieve.First, pick your trust services categories that were listed in Part 1 of this blog. You don’t need to become compliant with all five trust principles if you don’t want to.  If your firm has limited resources, you may consider pursuing just security, as it is the only required principle.  Or you can pursue the most vital principles or those which promise the most potential value based on your company and industry.   
  1. Get an initial audit or readiness assessment.  After picking your criteria, conduct an initial audit. You can do this within your organization, but you should bring in an external auditor for the best results.  During the assessment, your auditors will ask you a barrage of questions about your systems as they examine them.  In the end, you will get a report on your current systems and internal controls. This should give you a sense of what gaps may exist between you and compliance with your chosen principles.  It also shows you what kinds of changes you will have to make to achieve SOC 2 compliance.  
  1. Implement the necessary improvements and changes.  Next, you will implement changes to come into compliance with SOC 2; this will require functional area and executive buy-in to accomplish.  It will take several months to build, document, maintain, and audit processes and policies through cross-functional organizational cooperation.  Upon finishing your SOC 2 work, make sure that everyone in the organization follows these processes and policies as written by adding auditing. As a result, you will build good security habits across the organization which is what you are truly working to accomplish.
  2. Conduct the formal SOC 2 audit.  Inform your auditor that you would like to undergo a formal SOC 2 audit. Your auditor will then examine and test your systems and controls, asking you plenty of questions about them.  Assuming everything goes well, you will receive a SOC 2 audit report with an unmodified opinion which means the auditor found nothing wrong on a material level.  Or you will have changes that will need to be made.  
  1. Monitor and recertify.  When it comes to security, the work never ends.  You must bring in auditors every year to check that you are still compliant with SOC 2.  The continuous work will pay off, though, when you can flaunt your organization’s adherence to the most rigorous standards of security.  

How to get your ISO 27001 certification  

  1. Get your implementation team together and develop your plan.  First, assemble an implementation team that will have a dedicated project leader who has a good understanding of information security and your organization. The next step is to determine precisely what they must do to comply with ISO 27001; as an output, the team should determine the cost and timeline to achieve.  At this stage, the team should create a detailed outline of their objectives and plan.  
  1. Define the information security management system (ISMS) scope.
  • The next step is to determine the scope for the implementation of the ISO standard, including the balancing of the team and organizational activities that occur in normal business operations.  This will require you to realistically balance the time and resources because your business still needs to conduct its core business activities.  You don’t want the scope to be too small, as you will leave sensitive information exposed. However, if it’s too large, the project will become too complicated and expensive.   
  • You will also want to identify the bare minimum level of security you’re going to need to keep things secure. This can be done at the end of your risk assessment.  
  1. Perform a risk assessment and document a risk management process.ISO 27001 lets you define and design your own risk management process as long as you follow the five-step process indicated below to make decisions about this process and compliance with the standard:  
  • Establish a risk assessment framework  
  • Identify risks  
  • Analyze risks  
  • Evaluate risks  
  • Select risk management options  
  1. Develop your risk plan and monitoring.  This stage involves building your risk treatment plan for the organizational adoption of the standard:  
  • Controls and processes that will keep information within your business safe and compliant with the ISO 27001 guidelines.  These controls then need to be adopted and trained internally to ensure individual understanding, effectiveness, and audit readiness.  The employees need to understand their fit into the security framework and how it contributes to overall organization security and risk.  As with all things, these controls and processes will need to be audited, tested, and measured to ensure compliance.    
  • You should also conduct internal audits to see how processes work in action as  test runs for the real audit.  This will also help you continuously improve your operation and security/risk profile. 

5. Time for the audit. Finally, hire an accredited external auditor.  With an accredited auditor you will need to conduct two audits.  One is to validate the processes, policies, and controls to the ISO 27001 guidelines.   The second is to validate the implementation and effectiveness of real operation compliance to the ISO 27001 requirements.   

If you have questions about cybersecurity or controls, reach out to us at info@peters.com.  We are happy to help!