Category: Uncategorized

Security Certification is a big issue nowadays.
Everyone talks about it; everyone thinks everyone else masters it, but still, only a handful knows how to approach it.

Working with hundreds of organizations, small and large alike, we realized that companies generally don’t understand compliance concepts, master the processes, or even know where to begin. Usually, compliance is perceived as a pain-in-the-neck that must be ‘somehow’ solved and removed from the way.

Let me try and answer some of the basic unasked questions that run in everyone’s minds:

Who should meet security compliance and why?

Practically any company with a software-based offering should comply with at least one security standard. Achieving compliance is imperative to create trust with customers and federal regulators and serves as a solid and field-tested foundation for your security program.

What are the differences between ISO 27001 and SOC 2?

In general, both SOC 2 and ISO 27001 help you verify your company’s security posture and help you establish well-formed and secure processes. However, ISO 27001 exhibits a more process-oriented approach, focusing on people, policies, procedures, and technology. SOC 2, on the other hand, is more rigorous and goes deeper into the intrinsics of security configurations, cloud platforms and SaaS tools settings, development lifecycle security, and more.

What is the difference between SOC 2 type 1 to SOC 2 type 2?

SOC 2 type 1 audit will review your compliance at a specific time; thus, it provides only a limited assurance for your customers. In a SOC 2 type 2 audit, your auditor will review evidence collected over time, usually three months if that is your first audit or twelve months in most other cases. Proving compliance over time elevates your overall security and data handling posture.

What does ISO 27001 clause 5 mean?

ISO 27001 clause 5 requires that the person or group managing the organization demonstrate leadership concerning the core principles of information security by defining the mission statement, strategy, and goals. In practice, it mandates the definition and implementation of an information security policy and the specific properties it should include. It also requires management to assign information security authorities and responsibilities.

What are ISO 27001 and SOC 2 mandatory requirements?

Both SOC 2 and ISO 27001 standards mandate policies and procedures to reflect the secure nature of people and technology-related operations. On top of that, both standards will require an organization to provide evidence pointing to the adequate implementation of a list of information security controls. In general, SOC 2 and ISO 27001 cover multiple operational categories, including security, confidentiality, availability, and data integrity aspects.

Is there a SOC 2 & ISO 27001 compliance checklist?

The SOC 2 and ISO 27001 standards have formal evaluation criteria, as made available for auditors and auditees by the American Institute of CPA (AICPA) and the International Organization for Standardization (ISO) institute. However, since compliance is not a one-size-fits-all process, it is advisable to leverage an intelligent solution that can generate an audit scope matching your specific IT and operational environments.

Is ISO 27001 and SOC 2 certification worth it?

In recent years, the global economy has experienced an exponential rise in cyber attacks on companies and individuals alike. This gloomy reality has brought the federal government and the private sector to require vendors’ highest security assurance levels before engaging in business. The best and most effective way to communicate your cybersecurity posture to prospective customers is to adopt one or more of the abovementioned security standards. One can claim that today, SOC 2 and ISO 27001 have become true business enablers and are part of the cost of doing business.

Want to learn more about the compliance process?

Join Cypago for a webinar “What to Expect When You’re Expecting an IT Compliance Audit”, hosted by Cypago co-founder and CEO Arik Solomon, to learn the basics about SOC 2 and ISO27001 compliance. Save Your Seat!

Unicorns grow fast, super-fast.

It is not rare to see a Unicorn company doubling or even tripling its employee count in one year.

Thinking about our customer unicorn and soonicorn companies, it is clear that they experience immense growing pains and even much more than established companies.

It is the inevitable result of their fast growth, processes that worked just fine when the company was small enough are quickly becoming inadequate, demanding too much effort and resources. As the team at Trello noted, fast-growth might cause interference with forward-looking activities such as research and innovation. Ultimately, the growth itself might significantly slow down if not handled the right way.

Such is the case when trying to achieve and maintain compliance with security standards in a fast-growing environment.

Security Compliance For Unicorns

Compliance is no simple task, even for small to medium businesses due to its manual and labor-intensive nature. However, for the Unicorn, it has become a highly ineffective process.

For example:

• User access review is an essential requirement in most modern security standards such as SOC 2 and SOX-ITGC. It mandates that a user permission would be reviewed several times each year to verify that user access is properly authorized and administered.For a 20 or 50 employee company, this mission is possible.
  Yet what happens when almost overnight the business grows and has hundreds or even thousands of employees?Scanning the long 1000+ list of usernames, from dozens of different tools, manually trying to identify which nickname in one system relates to which employee in the Human Resources system – This is almost impossible and will not be a cost-effective task.
• The same is true when handling change management reviews. Most security standards require businesses to have a process in place that authorizes, documents and approves all changes to their infrastructure, data, or software.
  I’ve seen teams sifting through mega lists of thousands of records, manually cross-referencing them with thousands of other records only to be able to verify that a specific checked-in version was appropriately linked to the right ticket.

Intelligent Compliance – The remedy for Unicorn growing pains

When growing fast, entering new markets, or operating in new regions, GRC and security teams must do more than the same old manual compliance processes. Pouring in more resources or adding more human resources to the team can decrease the audit overload only minimally.

What is needed to close the gap and become an effective business enabler is an intelligent technology that can do all the heavy lifting and remove all compliance friction, both internally and externally.

What’s needed is a platform that can quickly connect to the existing SaaS stack and not only will collect the required evidence, but also analyze it, correlate distributed pieces of data into meaningful, actionable data, and can tell you in an intuitive and easy-to-use interface what your compliance status is.

Imagine a platform that will do all of that, and in addition allow automatic remediation of existing compliance gaps swiftly. This is the ultimate solution to the growing pains.

It’s Time for Intelligent Compliance with Cypago

Say goodbye to security audit friction.

With Cypago’s Compliance Orchestration Platform you get:

• Effort reduction by up to 90% – From scoping to compliance monitoring and data reviews, Cypago’s platform smoothly and automatically runs you through all the various audit phases
• Increased ROI – With a real intelligent solution as opposed to basic compliance tools, be assured you are investing in a technology that allows you to improve your return on existing tools
• Flexible and customized audits – Instantly get an audit scope that is specifically tailored to your setup and needs. Quickly align your scope with your auditor’s language and requirements using our advanced Scoping engine.
• Get continuous compliance assurance – Point-in-time compliance is far from satisfying today’s information security risks. You need an intelligent platform that will continuously monitor your overall compliance status and will watch your back, no matter how fast your organization grows

Learn more about the Cypago platform and leverage the power of our innovative technology to achieve compliance with any security standard in your fast-growing environment.

To schedule a demo or answer any questions contact me directly arik@cypago.com

In today’s demanding security, privacy and compliance requirements, an overwhelming effort is needed so that your organization is able to demonstrate compliance with one or more security standards. Which alone is a key business enabler, and in many cases a bottleneck for growth.

“We need all our user permissions data from all relevant platforms to be reviewed on time for our upcoming audit…” Says every company looking to expand their business and prove that they are security compliant. Or all too often requests come from the Business, Legal or Finance departments with multiple other requirements that involve additional stakeholders, piles of data and documents, with tedious repetitive tasks. Essentially the endless paper trail chase and definition of “company friction”.

So you have used Excel sheets and sticky notes to handle it, and maybe even played around with a semi-automated tool, but to no avail – the heavy lifting is still yours to do.

Intelligent Compliance – The right way to go

From my many years of experience, I can wholeheartedly say that cutting-edge technology combined with a field-proven approach is your best bet. But it is not enough – Your need to serve your business needs best while investing as little effort as possible in the compliance process must be the cornerstone of any tool you search for.

When reviewing security compliance solutions look for a holistic solution with important features and capabilities that:

• Supports multiple security standards, including custom audits and controls
• Collects only the relevant pieces of evidence across data silos and keep your data safe and secure
• Does intelligent gap analysis based on machine learning and data correlation
• Provides you with not only visibility but also enables automatic gap remediation

Find that one solution that allows you to effectively focus on other critical tasks rather than waste time on compliance friction.

This is exactly where Cypago’s intelligent compliance solution comes into play to completely turn the tables for you.

It’s Time for Intelligent Compliance.

Say goodbye to security audit friction.

Learn more about the Cypago platform and leverage the power of our innovative technology to achieve compliance with any security standard in your fast-growing environment.

To schedule a demo or answer any questions contact me directly arik@cypago.com