Podcast
Questions and Answers
What does 'Left of Boom' refer to?
What does 'Left of Boom' refer to?
- Controls to put in place if you are starting from nothing
- An entity that uses the services of a service organization
- A practitioner that reports on the internal controls at a service organization
- Identify and Protect steps of the NIST Cybersecurity Framework (correct)
What are the CIS Top 18?
What are the CIS Top 18?
- Controls to put in place if you are starting from nothing (correct)
- A series of questions for evaluating risks
- A redacted report for public sharing
- Very hard to achieve compliance
What does 'True Compliance' imply?
What does 'True Compliance' imply?
Very hard to do. Just because a company says they are compliant means they're probably not.
What should drive cybersecurity standards?
What should drive cybersecurity standards?
Who must sign off on a SOC report?
Who must sign off on a SOC report?
What is a vendor questionnaire?
What is a vendor questionnaire?
Who should have an NDA in place when viewing a SOC report?
Who should have an NDA in place when viewing a SOC report?
What is an attestation?
What is an attestation?
Why conduct a SOC audit?
Why conduct a SOC audit?
Who owns the service auditor test?
Who owns the service auditor test?
What organization governs audit categories and criteria exceptions?
What organization governs audit categories and criteria exceptions?
What is a service auditor?
What is a service auditor?
What are Complimentary Subservice Organizational Controls (CSOC)?
What are Complimentary Subservice Organizational Controls (CSOC)?
What are Complimentary User Entity Controls (CUEC)?
What are Complimentary User Entity Controls (CUEC)?
What is a Subservice Organization?
What is a Subservice Organization?
What is a User Entity?
What is a User Entity?
What does SOC 1 involve?
What does SOC 1 involve?
How do I know if I need a SOC 1?
How do I know if I need a SOC 1?
What does SOC 2 focus on?
What does SOC 2 focus on?
What is SOC 3?
What is SOC 3?
What does SOC 2+ bring into scope?
What does SOC 2+ bring into scope?
What is a Type 1 report?
What is a Type 1 report?
What is a Type 2 report?
What is a Type 2 report?
Match the Trust Service Categories:
Match the Trust Service Categories:
What are the levels of system categorization according to NIST RMF?
What are the levels of system categorization according to NIST RMF?
What does 'Assess security controls (NIST RMF)' usually entail?
What does 'Assess security controls (NIST RMF)' usually entail?
Who authorizes an information system according to NIST RMF?
Who authorizes an information system according to NIST RMF?
What is a CAP audit?
What is a CAP audit?
What does the system categorization level follow?
What does the system categorization level follow?
What is Document Control Implementations?
What is Document Control Implementations?
What is NIST 800-18?
What is NIST 800-18?
What does the System Security Plan (SSP) document?
What does the System Security Plan (SSP) document?
Study Notes
Cybersecurity Frameworks and Concepts
- Left of Boom: Focuses on the Identify and Protect steps of the NIST Cybersecurity Framework to avert incidents.
- CIS Top 18: Initial security controls recommended for organizations starting from scratch.
- True Compliance: Achieving genuine compliance is challenging; stated compliance often does not reflect actual status.
Audits and Reporting
- Audit Actions: Compliance should not dictate cybersecurity standards; leverage relevant controls during audits to demonstrate practices.
- SOC Report Signer: Must be signed by a Certified Public Accountant (CPA) to validate its authenticity.
- Vendor Questionnaire: Used for evaluating or assessing risks associated with vendors.
- SOC Report Viewer: Individuals accessing SOC reports must have a Non-Disclosure Agreement (NDA) in place for confidentiality.
- Attestation: Represents an opinion regarding compliance or practices.
- Why SOC: Offers efficiency through a single audit that can serve multiple reporting purposes.
Audit Governance and Roles
- Service Auditor Test: Conducted by the service auditor, ensuring adherence to controls.
- AICPA: The American Institute of Certified Public Accountants governs audit categories and criteria exceptions.
- Service Auditor: Reports on internal controls at service organizations, ensuring compliance and effectiveness.
- Complimentary Subservice Organizational Controls (CSOC): Expected controls at the subservice organization supporting user entities.
- Complimentary User Entity Controls (CUEC): Anticipated controls at the user entity that utilize services.
Service Organizations and User Entities
- Subservice Organization: Performs some services for user entities relevant to their internal control over financial reporting.
- User Entity: An organization that uses services from a service organization impacting its financial statements.
Types of SOC Reports
- SOC 1: Focuses on IT General Controls (ITGC) and financial controls.
- SOC 2: Concentrates on security as a critical criterion in assessments.
- SOC 3: A public-facing report, designed on existing audit reports, meant for marketing purposes.
- SOC 2+: Integrates various frameworks into the assessment scope.
- Type 1 Report: Evaluates conditions at a specific point in time.
- Type 2 Report: Assesses conditions over a defined period, with a full-year evaluation being the gold standard.
Trust Service Categories
- Trust Service Categories: Include Security, Availability, Processing Integrity, Confidentiality, and Privacy. Core categories are Security, Availability, and Confidentiality; specific focus depends on the scope.
NIST Risk Management Framework (RMF)
- Categorize the System: Systems categorized as low, moderate, or high; most (80%) qualify as moderate. High systems are resource-intensive.
- Assess Security Controls: Typically performed by an independent auditor to evaluate control effectiveness.
- Authorize Information System: CIO or system owner validates audit results, manages unimplemented controls through a Plan of Action and Milestones (POAM), and accepts risks before system authorization.
Miscellaneous
- CAP Audit: Conducted annually for corrective action plans to ensure compliance and security practices.
- System Categorization Level: Adopts the highest categorization for security assessments.
- Document Control Implementations: Often handled while systems are operational, signifying the need for a robust System Security Plan (SSP).
- NIST 800-18: A guideline for developing security plans for federal information systems.
- System Security Plan (SSP): A comprehensive document detailing how security controls are implemented, including rationale, serving as a living document.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Test your knowledge on key terms and concepts in Governance, Risk, and Compliance (GRC) with these flashcards. This quiz covers essential frameworks like the NIST Cybersecurity Framework and CIS Top 18, and emphasizes the importance of true compliance and audit actions. Perfect for GRC professionals looking to refresh their understanding.
