Category: Cyber Security

Home / Cyber Security
Aug172018

COSO Enterprise Risk Management

COSO Enterprise Risk Management

When an organization aims to achieve its objectives, it must address risks that threaten these objectives and manage them. COSO has defined various elements of an internal control system for this purpose. The COSO model depicts the direct relationship between:

  1. Organizational objectives;
  2. Control components;
  3. The activities/units requiring internal control.
  4. COSO identifies the relationships between enterprise risks and the internal control system. COSO operates under the notion that internal control is a process aimed at ensuring the achievement of objectives in the following categories:
  5. Achieving strategic objectives (Strategic);
  6. Effectiveness and efficiency of business processes (Operations);
  7. Reliability of financial reporting (Reporting);
  8. Compliance with relevant laws and regulations (Compliance).

Furthermore, organizations must demonstrate to investors and other stakeholders that they handle uncertainties correctly (Code Tabaksblat and the Sarbanes-Oxley Act). In the Risklane approach to Enterprise Risk Management (ERM), risks are identified, and their consequences are detailed. Risklane utilizes the latest standards, methods, and techniques in risk management for this purpose.

Aug122018

Steps to Successful Risk Management

Steps to Successful Risk Management

Risk management is a tool to systematically and explicitly identify, evaluate, and better manage risks by addressing them proactively. Risk management is based on conducting risk analyses.

In risk management, risks are controlled by determining how to manage the likelihood of the risk occurring or its consequences for identified risks.

The company identifies risks, understands as much as possible the financial implications of the risks, and implements measures accordingly. By considering the possible risks of certain policies at an early stage, these can be prevented or any serious consequences can be mitigated.

A one-time risk analysis is not sufficient. Only when the risk analysis is regularly repeated and updated, and the resulting measures…

STEP 1: IDENTIFYING RISKS

Risk identification encompasses all strategic, operational, financial, and traditional (damage) risks. The connection with the goals of the organization and business units is essential.

STEP 2: ANALYZING AND ASSESSING RISKS

Mapping out the risks allows for their analysis. A financial manager cannot stop at merely identifying risks. It is important to determine which risks are the greatest. Not all risks deserve the same attention; start with the most important ones.

STEP 3: ANALYSIS OF CURRENT CONTROL MEASURES

Companies can distinguish themselves from their competition by managing their risks more efficiently. In this phase, it must be determined whether the risks are not overly controlled and whether there are blind spots.

STEP 4: DESIGNING AND IMPLEMENTING ACTION PLANS

After the control measures have been mapped out, the financial manager must make a choice. What happens to the remaining risks? For each risk, they must choose from the following four options:

  • Avoid
  • Reduce
  • Transfer
  • Accept

STEP 5: MEASURING, MONITORING, AND REPORTING

Risk management is a continuous process. It is important to measure whether the action plans are affecting the risk profile. Risk information can also be used for planning audits.

STEP 6: INTEGRATING RESULTS INTO DECISION-MAKING PROCESSES

The risk information can be used for the analysis of future decisions (through risk analyses from the past). For each new investment proposal or major project, the organization must consciously take the risks into account.

Aug62018

What suits my organization better? SOC 1 or SOC 2?

What suits my organization better?

SOC 1 or SOC 2?

The SSAE18 standard (AICPA) from the United States includes two types of reports; a Service Organization Control Report 1 (SOC 1) and a Service Organization Control Report 2 (SOC 2). This terminology is increasingly being used internationally. An ISAE 3402 report is within this terminology a SOC 1 report, an ISAE 3000 report is a SOC 2 report.

An ISAE 3402 report is a report on how the service provider manages risks over the processes that are outsourced. Outsourcing, and more specifically financial processes, are the framework for this report. An alternative to this report is the SOC 2 report where outsourcing is not the primary framework, but rather information security. The criteria for information security and privacy are included in the Trust Service Criteria. Criteria related to security, privacy, availability, and confidentiality. Additionally, there is a SOC 3 report.

Do I need an SOC 1?

A Service Organization Control 1 is an audit of internal controls focused on securing client data. SOC 1 audits are conducted according to Statement on Standards for Attestation Engagements No. 16 (SSAE 16). A SOC 1 includes control objectives used for internal control over financial reporting. The financial statements are thus the framework for this report. This means that all processes are designed to ensure that all data in the financial statements is accurate and complete.

In other words; if you process or host data related to a financial process, then SOC 1 is applicable.

Do I need an SOC 2?

If you process or host data that do not affect your clients’ financial statements, then SOC 2 is applicable. In this case, your clients are mainly interested in whether you handle information security and privacy correctly.

In an SOC 2 report, similar to an SOC 1 report, internal control measures are included.

Which type of report is best for me now: SOC 1 or SOC 2?

An important difference is that privacy is not mandatory in an SOC 1 and in an SOC 2 based on the Trust Service Criteria, it is. If you have clients falling into both categories, there is a reasonable chance that you will be asked to provide both. You can determine whether you need an SOC 1 or SOC 2 report to fulfill the needs of a wide variety of clients. Risklane offers a unique Online Audit Tool (ControlReports) that supports you in integrating the SOC 1 and SOC 2 audits, resulting in two separate reports. At no extra cost.

If you want more information about the impact of SOC 1 (ISAE 3402), SOC 2 (ISAE3000) for your organization, please contact Securance (+31) 030 2800888.

Jun142018

Security of IT service while working from home

Security of IT service

while working from home

Currently, more people are working from home than ever before, bringing numerous risks for organizational security. Global data breaches are on the rise, potentially causing significant consequences for businesses. By maintaining security control, organizations can not only retain customer trust but also mitigate financial losses.

ISAE 3000 is the standard for assurance on non-financial information. In practice, there is often a demand for an SOC 2 report. This SOC 2 report exclusively includes General IT Controls that comply with the Trust Service Criteria of the AICPA. These Trust Service Criteria are best practices from the United States for security, privacy, confidentiality, availability, and integrity.

What are the best ways to keep remote work as secure as possible?

1. Password management.

The widely recommended tip is to use strong passwords. Ensure that your employees create multiple different passwords. Frequently changing passwords can also enhance security. Also, ensure that private and work user accounts are separated. As logging in with a private account at home is often easier, it can jeopardize security.

2. Screen locking during breaks.

It sounds like a logical step, but screen locking is often overlooked. Unexpected events can occur when the screen is not locked. This is a matter of habit. The following combinations should be used:

  • Windows: Win + L
  • Mac: Cmd + Ctrl + Q

3. Keep private and work separate.

As mentioned earlier, keep private and work separate. Different passwords, private and work-related, should not be stored on the same drive. Also, an employee should never use their work email for external websites.

4. Secure WIFI connection.

A secure WIFI connection sounds simple, but mistakes are often made. People often make the mistake of logging into a public WIFI service instead of using a phone hotspot in public. Always instruct employees that if they work in public, they must always use their own hotspot instead of an unsecured WIFI service.

5. VPN.

It’s best to work on a VPN connection when working from home. A VPN connection reduces the risk of hackers and data breaches. Additionally, it’s important to follow browser warnings; if a site doesn’t feel right, it probably isn’t.

6. Security programs.

There are various security updates available for computers, often automatically installed when booting up or shutting down the computer. Also, organizations should provide mandatory antivirus programs.

Risklane offers services in governance, risk, and compliance. Since 2014, Risklane has been a market leader and the most progressive organization regarding ISAE 3402 implementation and certification. Apart from ISAE 3402 services, we offer services in ISAE 3000, GDPR/AVG, ISO 27001, ISO 9001, and COSO ERM.