3 ms·

As someone who has performed SOC2 compliance reviews, these are not small tasks. I've performed them on companies that manage core banking systems for other ban

As someone who has performed SOC2 compliance reviews, these are not small tasks. I've performed them on companies that manage core banking systems for other banks and credit unions. Currently, across quite a lot of critical infrastructure there are legacy systems which are EoL. However, there are aspects or layers to the software which are not, or are protected by higher layers of security. If your vendors ENTIRE environment is almost EoL software and hardware then yes that is highly concerning and would make it very difficult for them to demonstrate appropriate security controls. However, the reality is that most of the environments I have assessed have only a small portion of their software/hardware environment that is EoL. That is often protected by significant layers of security above that.

JustARandomGuy 6y ago
Out of curiosity, when you're doing a SOC2 compliance review, are your relying on their documentation of security measures, or would you check to see that the documentation matches the security measures that are in place?
- NoPicklez 6y ago
  Documentation of security controls means very little, yes having a framework with a suite of policies and procedures is important. But a proper SOC 2 review is all about actually seeing it in place. We do a deep dive, where we understand all of the security controls, we then test the design of these security controls through reviewing security configurations within the systems themselves. Then testing the effectiveness of these controls. So yes, we review documentation and then perform an independent review of the security measures/controls in place. For instance, understanding how batch processes are configured, then testing that the appropriate security controls in relation to batch processes operated effectively.
- user5994461 6y ago
  Both usually. The auditor have a list of a thousand and they want to verify. Not enough to say that you have a list of active devices, need to show them an inventory. Not enough to say there is authentication, need to show them that they can't access the homepage.

JustARandomGuy 6y ago

Out of curiosity, when you're doing a SOC2 compliance review, are your relying on their documentation of security measures, or would you check to see that the documentation matches the security measures that are in place?

NoPicklez 6y ago
Documentation of security controls means very little, yes having a framework with a suite of policies and procedures is important. But a proper SOC 2 review is all about actually seeing it in place. We do a deep dive, where we understand all of the security controls, we then test the design of these security controls through reviewing security configurations within the systems themselves. Then testing the effectiveness of these controls. So yes, we review documentation and then perform an independent review of the security measures/controls in place. For instance, understanding how batch processes are configured, then testing that the appropriate security controls in relation to batch processes operated effectively.
user5994461 6y ago
Both usually. The auditor have a list of a thousand and they want to verify. Not enough to say that you have a list of active devices, need to show them an inventory. Not enough to say there is authentication, need to show them that they can't access the homepage.