SOC 2

1st November 2024

SOC 2 Penetration Testing Requirements

You’d never buy a home without a home inspection. But there’s a difference between a passable inspection to enable your sale and a more thorough, high-quality one. After all, the point is to discover potential risks in your prospective new home so you can address these issues ahead of time… rather than just “pass” an…

29th June 2024

How much does SOC 2 Certification cost in 2025?

One of our most frequently asked questions is, “How much does SOC 2 certification cost?” Frankly, most content on the topic is disappointing and doesn’t actually address the question. But unlike other sources, we’re going to give you a detailed look at: One quick clarification before we go further – technically, there is no such…

28th March 2024

10 ways Fractional CISO helps you become SOC 2 compliant.

Since you’re here, it’s safe to assume that your organization needs a SOC 2 report and you’re considering Fractional CISO’s help to get it done. Thanks for the interest! We realize that, when discussing long-term consulting projects, the specific work that gets done can seem pretty vague. The point of this article is to give…

6th April 2023

SOC 2 Cloud Security Requirements

Carefully secure your cloud environment – or risk ending up on prospective customers’ No Fly Lists! The cloud has been a boon for businesses, giving many organizations access to convenient, scalable, and cost-effective computing power – without the hassle of building and maintaining an on-site data center! The cloud has also been a boon for…

2nd February 2023

SOC 2 Physical Security Requirements

You spend all of your time carefully configuring all of your technology and network to make it as difficult as possible for an attacker to compromise you… only for your penetration tester to walk in your front door and walk out with three laptops and a hard drive filled with your confidential data. This is…

19th January 2023

Guide to the SOC 2 Confidentiality Trust Services Criteria

You should have listened to that warning your gut made when you decided to pick Messy Mike’s Money Tracker to track your company’s finances. There had to be some reason it was so affordable, right? There was. Today, when you logged in, all of your financial records were missing. The app looked just like it…

8th December 2022

What is a cybersecurity compliance audit actually like?

“You’re going to be audited by the IRS.” Is not a phrase most people would want to hear – so it makes sense that the word “audit” carries some negative weight. Being “audited” is something most people would normally prefer to avoid. In the cybersecurity compliance world, “audit” is a common common phrase, and a…

10th November 2022

SOC 2 incident response: what’s required for compliance?

For SOC 2, incident response is an absolute must. If you don’t have a well-practiced plan, you’re not compliant, period. Why? To prevent scenarios like this: You get a panicked call from one of your employees at 4 pm on a Friday. “One of our data processing vendors has been hit by a ransomware attack!…

11th August 2022

The Makeup of a Great SOC 2 Risk Assessment

Not all risk assessments are created equal. Some are low and others are high. Yeah, that’s really helpful. Right? Risk assessments are so crucial to information security that the American Institute of Certified Public Accountants (AICPA) requires them from every single company seeking SOC 2 compliance. SOC 2 Risk Assessments fall primarily under the Security…

30th June 2022

Guide to the SOC 2 Security Trust Services Criteria

Even a choose-your-own-adventure book has a certain structure to it. Sure, you might be making your own way through the book, but there are still plot points, challenges, and decisions the author will include along every path. SOC 2, being the choose-your-own-adventure cybersecurity compliance standard, is similar in this regard. An organization pursuing a SOC…