Industry Standards for Risk Assessment
Transcript
When you’re selecting your framework under which to do an audit, each framework targets a different and specific realm of information security. When we talk about using the NIST framework, we’re talking about a standards-based approach to information security controls. The ISO 27000 series framework talks about best practices in your information security and IT controls. While the SOC 2 framework talks about the intersection of risk and your information security controls. This makes the SOC 2 framework fairly unique. It gives the risk assessment in a SOC 2 a special consideration. While the framework itself, derived from COSO principles, talks about management systems integrity and details our requirements at a very high level for evaluating you. Your risk assessment gives the assessor guidance as to what things are most important for your management style and your organization. The risk assessment in a SOC 2 guides the assessor into looking at those controls that have meaning for your organization and for the organizations for which you do business, at which the SOC 2 report is aimed.
When you’re selecting your framework under which to do an audit, each framework targets a different and specific realm of information security. When we talk about using the NIST framework, we’re talking about a standards-based approach to information security controls. The ISO 27000 series framework talks about best practices in your information security and IT controls. While the SOC 2 framework talks about the intersection of risk and your information security controls. This makes the SOC 2 framework fairly unique. It gives the risk assessment in a SOC 2 a special consideration. While the framework itself, derived from COSO principles, talks about management systems integrity and details our requirements at a very high level for evaluating you. Your risk assessment gives the assessor guidance as to what things are most important for your management style and your organization. The risk assessment in a SOC 2 guides the assessor into looking at those controls that have meaning for your organization and for the organizations for which you do business, at which the SOC 2 report is aimed.
