Category: Assurance

Home / Assurance
Jan12021

ISO 27001 and Ransomware

ISO 27001 and Ransomware

In recent times, an increasing number of companies have been affected by ransomware. Another term for ransomware is “hostage software.” REvil is a well-known group that employs this tactic, rendering thousands of companies unable to access their files. But how can a company prevent a ransomware attack?

The so-called “hostage software” is aptly named. A ransomware attack can “hold hostage” a company’s computers and files. All files are temporarily encrypted and can only be retrieved upon payment, often in cryptocurrency, as it is untraceable. Ransomware can infiltrate documents through actions such as clicking on a malicious link or due to outdated security measures. This is why it is crucial to keep software within the company up-to-date.

Preventing Ransomware

In this case, prevention is better than cure. As easy as it is to install, ransomware can be challenging to remove. Furthermore, removing the software is often ineffective and incomplete. Therefore, prevention is the best solution.

Every company can address the following vulnerabilities:

  1. As mentioned earlier, it is essential to use the latest operating and security systems.
  2. All programs should also be up-to-date to avoid potential vulnerabilities.
  3. Never click on suspicious links in emails. Many spam emails often contain malicious links. Always verify if an email is legitimate or from a potential client with inquiries.
  4. Obtain ISO 27001 certification. Information security is crucial for every company. The ISO 27001 standard is an international framework for information security. ISO 27001 can be used to implement information security measures.

Securance has over 10 years of experience in implementing risk management structures, information security, and process improvement. Information security should always provide added value, making the organization more manageable, and ISO 27001 offers opportunities for attracting new clients.

Jan12021

Benefits of High Level Structure

Benefits of High Level Structure

There is often discussion about High Level Structure (HLS) in ISO standards. But what does this entail? What are the requirements that a company must meet, and what are the benefits of HLS for ISO standards?

The new ISO standards we know today are based on the HLS structure. HLS can be described as a universal standard for management system standards, enabling integrated business management. For every company, information security is crucial. The ISO 27001 standard is an international framework for information security. ISO 27001 can be used to implement information security measures. In 2017, the latest ISO 27001 standard was published. This standard is based on the HLS structure. HLS stands for High Level Structure and refers to the initiative to develop a ‘structure on main lines’ for management system standards. The HLS structure is based on the plug-in model. This plug-in model is ISO’s response to market demands to ensure that management system standards are interconnected and logically related.

HLS

The new ISO standards are easier to integrate through the High Level Structure. What makes HLS ideal is that a single basic system needs to be established, and from here, different standards can be “plugged in.” There are several requirements that an organization must meet for the implementation of HLS.

  • Risk management
  • Leadership
  • Compliance management (also necessary for an ISO standard)
  • Demonstrability
  • Improvement management

Benefits of HLS in the Organization

As described, the HLS system makes it increasingly easier to implement different ISO standards within the organization. This ensures that management system standards are interconnected and logically related. From here, the needs of stakeholders are central. HLS ensures that the organization’s management takes a more direct role and is more involved in implementing the management system.

Securance offers services in governance, risk, and compliance. Securance has been the market leader in the Netherlands and the most progressive organization in ISAE 3402 implementation and certification. We offer services in ISAE 3000, GDPR/AVG, ISO 27001, ISO 9001, and COSO ERM, in addition to ISAE 3402.

Jul12020

The right steps to achieve ISAE 3000 | SOC 2

The right steps to achieve
ISAE 3000 | SOC 2

Organizations are facing more security threats than ever before. To differentiate your organization from the competition, it is necessary to demonstrate your commitment to addressing these threats.

ISAE 3000 | SOC 2 is the leading standard for demonstrating the design and operational effectiveness of your security, risk, and control practices. The standard is a tool that enables organizations to manage a control system tailored to their own branding and culture. However, it also ensures that processes follow best practices. The ultimate goal is to produce a report that provides transparency and a secure organization. It offers a simple reference point for your clients to be certain and demonstrate their own compliance for using your services.

There are several steps to achieving ISAE 3000 | SOC 2.

Contact an ISAE 3000 | SOC 2 Provider

Because this standard involves a lot of complicated terminology, it can be confusing for an organization to work with. It is often unclear which standard best fits the organization and what is actually required to meet these requirements. This is why it is time-saving to contact a provider who can easily guide the organization through this process.

ISAE 3000 | SOC 2 Scope

Whether the organization is working on an ISO 27001, ISAE 3402 | SOC 1, or ISAE 3000 | SOC 2 standard, it is important to determine which scope applies. This is what the end-user (organization and client) would want assurance about. It involves the services, systems, and criteria that apply. For example, organizations may have different types of entities and services. It is not necessary to include all of these services if they are not relevant to the requirements of the end-users. For an ISO 27001 standard, only security is reported, while for an ISAE 3000 | SOC 2, availability, confidentiality, privacy, and processing integrity are also considered.

ISAE 3000 | SOC 2 Service Auditor

Many organizations still hesitate to approach a service auditor. This is often because there is a perception that the organization can handle it itself. However, engaging a service auditor is much more promising. As described, there are many complicated terminologies, and this can be confusing.

Securance offers organizations the ability to independently implement various governance, risk, and compliance standards within the organization using the ControlReports application. ControlReports is based on the latest best practices in the market for risk management and information security.

Securance offers services in governance, risk, and compliance. Securance is the market leader and most progressive organization in ISAE 3402 | SOC 1 implementation and certification.

Audit

Unlike a fiscal or financial audit, ISAE 3000 | SOC 2 and ISO 27001 audits are not trying to catch you out. The auditor is looking for documentation or other evidence to prove that your practices are what you say they are. For ISAE 3000 | SOC 2 Type 2, the auditor also verifies that you are actually applying the practices in accordance with how you say you are.

ISAE 3000 | SOC 2 System Description

ISAE 3000 | SOC 2 is an assurance report and not a certification like ISO 27001. However, many end-users see them as the same. The main difference is that ISAE 3000 | SOC 2 requires a system description that describes the scope, relevant processes, business practices, controls, and auditor validation procedures through a scope.

ISAE 3402 | SOC 2 is less prescriptive than ISO 27001. It also includes additional controls for the user organization and the subservice organization, so users can understand what is and is not covered by the report concerning the users’ own responsibilities and the key suppliers used in delivering the services.

Reporting ISAE 3000 | SOC 2 Achievement

It is the responsibility of the organization to report on achieving the standards. This can bring many benefits and lead to much greater customer satisfaction. However, there are conditions attached to sharing this information. It must be shared in an appropriate manner, not in an incomplete form, and must not be misleading to end-users.

Nov292019

The ISO 9001 stakeholders

The ISO 9001 stakeholders

The first step is to identify the ISO 9001 stakeholders referenced in the standard, here it refers to people or organizations that will influence your ability to deliver products and services that reliably address your customers’ problems and legal issues. addressing issues necessities. List all things that affect your organization, such as customers, government organizations, non-governmental agencies, representatives, shareholders, suppliers, and so on.

When you have this list, a list of those you think could impact your ability to deliver your products and services, you can figure out which parties you think are most important to your company. 

ISO 9001 implementation can be challenging. The most important challenges are; limited time, budget constraints and experience with implementing a professional quality management system. A quality management system and certification in accordance with ISO 9001 plays a pivotal role in the operation of organizations.

In the current global market place the need to achieve ISO 9001 is increasing as a consequence of higher requirements from corporates and supervisory authorities. Requirements and needs vary from quality management (ISO 9001), to information security (ISO 27001 / ISAE 3000 | SOC 2)and assurance over outsourced processes (ISAE 3402 | SOC 1).

Example of ISO 9001 Stakeholders

  • Customers
  • People in an organization
  • Banks
  • Labor unions
  • Society
  • Pressure groups
  • Entrepreneurs
  • Providers
  • Government
  • Partners
  • Competitors