Category: Advisory

Home / Advisory
Jan12021

Benefits of High Level Structure

Benefits of High Level Structure

There is often discussion about High Level Structure (HLS) in ISO standards. But what does this entail? What are the requirements that a company must meet, and what are the benefits of HLS for ISO standards?

The new ISO standards we know today are based on the HLS structure. HLS can be described as a universal standard for management system standards, enabling integrated business management. For every company, information security is crucial. The ISO 27001 standard is an international framework for information security. ISO 27001 can be used to implement information security measures. In 2017, the latest ISO 27001 standard was published. This standard is based on the HLS structure. HLS stands for High Level Structure and refers to the initiative to develop a ‘structure on main lines’ for management system standards. The HLS structure is based on the plug-in model. This plug-in model is ISO’s response to market demands to ensure that management system standards are interconnected and logically related.

HLS

The new ISO standards are easier to integrate through the High Level Structure. What makes HLS ideal is that a single basic system needs to be established, and from here, different standards can be “plugged in.” There are several requirements that an organization must meet for the implementation of HLS.

  • Risk management
  • Leadership
  • Compliance management (also necessary for an ISO standard)
  • Demonstrability
  • Improvement management

Benefits of HLS in the Organization

As described, the HLS system makes it increasingly easier to implement different ISO standards within the organization. This ensures that management system standards are interconnected and logically related. From here, the needs of stakeholders are central. HLS ensures that the organization’s management takes a more direct role and is more involved in implementing the management system.

Securance offers services in governance, risk, and compliance. Securance has been the market leader in the Netherlands and the most progressive organization in ISAE 3402 implementation and certification. We offer services in ISAE 3000, GDPR/AVG, ISO 27001, ISO 9001, and COSO ERM, in addition to ISAE 3402.

Jul12020

The right steps to achieve ISAE 3000 | SOC 2

The right steps to achieve
ISAE 3000 | SOC 2

Organizations are facing more security threats than ever before. To differentiate your organization from the competition, it is necessary to demonstrate your commitment to addressing these threats.

ISAE 3000 | SOC 2 is the leading standard for demonstrating the design and operational effectiveness of your security, risk, and control practices. The standard is a tool that enables organizations to manage a control system tailored to their own branding and culture. However, it also ensures that processes follow best practices. The ultimate goal is to produce a report that provides transparency and a secure organization. It offers a simple reference point for your clients to be certain and demonstrate their own compliance for using your services.

There are several steps to achieving ISAE 3000 | SOC 2.

Contact an ISAE 3000 | SOC 2 Provider

Because this standard involves a lot of complicated terminology, it can be confusing for an organization to work with. It is often unclear which standard best fits the organization and what is actually required to meet these requirements. This is why it is time-saving to contact a provider who can easily guide the organization through this process.

ISAE 3000 | SOC 2 Scope

Whether the organization is working on an ISO 27001, ISAE 3402 | SOC 1, or ISAE 3000 | SOC 2 standard, it is important to determine which scope applies. This is what the end-user (organization and client) would want assurance about. It involves the services, systems, and criteria that apply. For example, organizations may have different types of entities and services. It is not necessary to include all of these services if they are not relevant to the requirements of the end-users. For an ISO 27001 standard, only security is reported, while for an ISAE 3000 | SOC 2, availability, confidentiality, privacy, and processing integrity are also considered.

ISAE 3000 | SOC 2 Service Auditor

Many organizations still hesitate to approach a service auditor. This is often because there is a perception that the organization can handle it itself. However, engaging a service auditor is much more promising. As described, there are many complicated terminologies, and this can be confusing.

Securance offers organizations the ability to independently implement various governance, risk, and compliance standards within the organization using the ControlReports application. ControlReports is based on the latest best practices in the market for risk management and information security.

Securance offers services in governance, risk, and compliance. Securance is the market leader and most progressive organization in ISAE 3402 | SOC 1 implementation and certification.

Audit

Unlike a fiscal or financial audit, ISAE 3000 | SOC 2 and ISO 27001 audits are not trying to catch you out. The auditor is looking for documentation or other evidence to prove that your practices are what you say they are. For ISAE 3000 | SOC 2 Type 2, the auditor also verifies that you are actually applying the practices in accordance with how you say you are.

ISAE 3000 | SOC 2 System Description

ISAE 3000 | SOC 2 is an assurance report and not a certification like ISO 27001. However, many end-users see them as the same. The main difference is that ISAE 3000 | SOC 2 requires a system description that describes the scope, relevant processes, business practices, controls, and auditor validation procedures through a scope.

ISAE 3402 | SOC 2 is less prescriptive than ISO 27001. It also includes additional controls for the user organization and the subservice organization, so users can understand what is and is not covered by the report concerning the users’ own responsibilities and the key suppliers used in delivering the services.

Reporting ISAE 3000 | SOC 2 Achievement

It is the responsibility of the organization to report on achieving the standards. This can bring many benefits and lead to much greater customer satisfaction. However, there are conditions attached to sharing this information. It must be shared in an appropriate manner, not in an incomplete form, and must not be misleading to end-users.

Nov292019

The ISO 9001 stakeholders

The ISO 9001 stakeholders

The first step is to identify the ISO 9001 stakeholders referenced in the standard, here it refers to people or organizations that will influence your ability to deliver products and services that reliably address your customers’ problems and legal issues. addressing issues necessities. List all things that affect your organization, such as customers, government organizations, non-governmental agencies, representatives, shareholders, suppliers, and so on.

When you have this list, a list of those you think could impact your ability to deliver your products and services, you can figure out which parties you think are most important to your company. 

ISO 9001 implementation can be challenging. The most important challenges are; limited time, budget constraints and experience with implementing a professional quality management system. A quality management system and certification in accordance with ISO 9001 plays a pivotal role in the operation of organizations.

In the current global market place the need to achieve ISO 9001 is increasing as a consequence of higher requirements from corporates and supervisory authorities. Requirements and needs vary from quality management (ISO 9001), to information security (ISO 27001 / ISAE 3000 | SOC 2)and assurance over outsourced processes (ISAE 3402 | SOC 1).

Example of ISO 9001 Stakeholders

  • Customers
  • People in an organization
  • Banks
  • Labor unions
  • Society
  • Pressure groups
  • Entrepreneurs
  • Providers
  • Government
  • Partners
  • Competitors
Nov82019

ISO 27001 and SOC 2 – The Comparisons

ISO 27001 and SOC 2 -The Comparisons

ISO 27001 is an international standard outlining the requirements for managing the security of assets such as financial information, intellectual property, employee and customer data, and third-party entrusted information. Created by the International Standards Organization, ISO 27001 also provides a guideline for Information Security Management Systems (ISMS), focusing on long-term data protection. An ISO 27001 certification signifies a significant investment in time and resources in security and provides a robust foundational building block for any organization’s security compliance program.

SOC (Service Organization Controls) is a set of standards developed by the AICPA for assessing and evaluating an organization’s control competencies. SOC for service organizations: Trust Services Criteria (also known as SOC 2 reports) are intended to meet the needs of a wide range of users who require detailed information and assurance about the controls relevant to the security, availability, and processing integrity of the systems used to process users’ data, and the confidentiality and privacy of the information processed by these systems. These reports can play a crucial role in organizational oversight, vendor management programs, internal corporate governance, risk management processes, and regulatory oversight.

There are two types of SOC 2 reports: Type 1 and Type 2.

A SOC 2 Type 1 audit provides a snapshot of the data protection measures present in an organization. The design of the controls is assessed and the implementation is confirmed, but consistent performance is not evaluated in a Type 1 report. If an organization is new to SOC 2, obtaining a SOC 2 Type 1 report is the first step.

A SOC 2 Type 2 audit addresses the operational effectiveness of controls over a specified period, such as six to twelve months. A SOC 2 Type 2 report sets a higher bar than a Type 1 report, as it not only assesses the design and implementation of control processes but also evaluates whether the controls were consistently performed during the specified period. This provides customers and business partners with greater confidence in the effectiveness of control processes.

These two security management frameworks have many similarities. Both are voluntary and designed to prove a company’s reliability in processing customer data while protecting the confidentiality, integrity, and availability of sensitive information. The frameworks share an equally respected and revered reputation, and customers view both as viable proof of your company’s ability to protect data. In short, having a SOC 2 Type 2 report or ISO 27001 certification will enhance your brand’s reputation and help attract new customers.

You don’t have to look hard to find logistical and operational similarities between SOC 2 and ISO 27001. The frameworks share many similar security requirements, making functional implementation and evidence collection time comparable. Both frameworks also require certified third-party validation assessments and periodic reassessments.