110 lines
3.8 KiB
Markdown
110 lines
3.8 KiB
Markdown
# Toward SOC 2
|
||
|
||
## Not everything is mandatory
|
||
|
||
You know better than anyone (including the auditor) what is best for your
|
||
company. You might have good reasons for performing or not a task as every
|
||
company is unique.
|
||
|
||
To help you evaluate the importance of each tasks you will run into, they are
|
||
labelled with three levels:
|
||
|
||
- **Mandatory** – The essential and fundamental elements. If you don’t have
|
||
those, your auditor or customer will ask questions, you better justify it.
|
||
- **Optional** – Your auditor or customer might ask questions if any of those
|
||
elements are necessary to mitigate a risk you have.
|
||
|
||
<details>
|
||
🗣
|
||
|
||
A good example is penetration testing.
|
||
|
||
- Penetration tests are expensive, but they can be a good investment, especially if you are running into a prospect requiring it
|
||
- However they probably wont make sense if you are at the MVP stage and you are gonna trash and rebuild your product in a few month
|
||
</details>
|
||
|
||
- **Advanced** – They show a great commitment toward security. Unless it is the
|
||
only way to mitigate a risk very specific to your company, you won’t be asked
|
||
about it.
|
||
|
||
## What’s next ?
|
||
|
||
We have regrouped what you need to do by different thematic in order to setup
|
||
the proper foundations for your company to get SOC-2:
|
||
|
||
<details>
|
||
|
||
**Pro tip:** Setup screenshot to clipboard You will have to take quite a lot of
|
||
screenshot until we automate most of it. We recommend that you setup a
|
||
screenshot to clipboard so you can just take a screenshot and paste-it saving
|
||
you ton of time. On mac:
|
||
|
||
- Use **CMD + SHIFT + 5** to enter screenshot mode
|
||
- Click options, to change “save to” to “clipboard”
|
||
- Now you can use **CMD + SHIFT + 3** to take a screenshot to clipboard
|
||
- And paste it in the right place with **CMD + V**
|
||
|
||
</details>
|
||
|
||
### Physical assets
|
||
|
||
Protect your physical environment to prevent data leaks or outages from
|
||
unauthorized access.
|
||
|
||
- [Secure your offices and internet access](physical/facilities/README.md)
|
||
- [Manage your computers](physical/hardware/README.md)
|
||
|
||
### Employees
|
||
|
||
Your team is your first line of defense—educate, empower, and secure them.
|
||
|
||
- [Set up your employees for success](personnel/lifecycle/README.md)
|
||
- [Secure your emails](personnel/comms/README.md)
|
||
- [Configure your system access](personnel/access/README.md)
|
||
|
||
### Core assets
|
||
|
||
These are the heart of your company—prioritize their security.
|
||
|
||
- [Secure your codebase](core/src/README.md)
|
||
- [Secure your infrastructure](core/infra/README.md)
|
||
- [Protect your network](core/network/README.md)
|
||
- [Safeguard your data](core/data/README.md)
|
||
|
||
### Alert & act
|
||
|
||
Be proactive and prepared—track activity and respond quickly to issues.
|
||
|
||
- [Log collection and monitoring](operations/monitoring/README.md)
|
||
- [Prepare for incidents](operations/incidents/README.md)
|
||
|
||
### Vendors
|
||
|
||
Keep your partnerships secure by managing third-party risks.
|
||
|
||
### Transparency
|
||
|
||
SOC 2 is about showing how you operate—document and share your processes.
|
||
|
||
- [Have a security page](TRA.001_have_a_security_page.md)
|
||
- [Clearly explain your services](transparency/TRA.002_clearly_explain_your_services.md)
|
||
- [External support available](TRA.003_external_support_available.md)
|
||
|
||
### Review and keep things up to date
|
||
|
||
#### Why does it matter?
|
||
|
||
Your company changes over time, and so should your security posture.
|
||
|
||
#### How can I proceed?
|
||
|
||
Some things don’t need review (eg: MFA is enabled), but your infrastructure and
|
||
your employee are changing.
|
||
|
||
⇒ You need to make sure people and digital asset with access are the one working
|
||
today in/with your company.
|
||
|
||
- [Remove unauthorized assets](core/infra/COR.INF.007_asset_decommissioning.md)
|
||
- [Conduct an access reviews](personnel/access/PER.ACC.006_periodic_access_review.md)
|
||
- [Test your disaster recovery plan](operations/incidents/OPS.INC.003_drp_testing.md)
|