Audit reports and certifications can be a useful investment in your overall security governance strategy to enable your company to:
Your clients may request various types of audit reports or certifications depending on the geographic location and the industry your business operates in. The list below outlines are the most commonly requested audit reports and certifications and their primary purpose.
AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, of Statement on Standards for Attestation Engagements (SSAE) No. 18, Attestation Standards: Clarification and Recodification.
A SOC 1 Audit Report gives your customers the assurance that your organisation’s controls are designed and operating efficiently and that these controls don’t negatively impact their financial statements.
You may need to comply with SOC 1 as part of a compliance requirement. For example, if your company is publicly traded, you will have to undergo a SOC 1 audit as part of the Sarbanes-Oxley Act (SOX).
SOC 1 audit costs vary, but audits typically range from $15,000 – $100,000 in cost.
AICPA Trust Services Criteria
A SOC 2 report gives your customers the assurance that your organisation’s security and privacy controls are designed and operating efficiently and that these controls don’t negatively impact or put at risk services you provide to them.
SOC 2 audit costs vary, but audits typically range from $25,000 – $200,000 in cost.
Australian Government Information Security Manual and PSPF
By meeting the requirements of the PSPF and ISM commercial entities can be IRAP Assessed which could open doors in providing services to Australian Government entities. The ISM is also very comprehensive and has some great guides and technical advice on how to implement controls across a a broad range of practice areas.
IRAP assessments cost between $50,000-$200,000
ISO/IEC 27001 - Information technology - Security techniques, Information security management systems Requirements - Second edition 2013-10-01
The ISO 27001 standard outlines the key processes and approaches to help your organisation manage information security controls using a risk-based approach. ISO 27002 Appendix A of ISP 27001 is a well defined list of controls that you are likely to be audited on when you apply for ISO 27001 certification.
ISO 27001 Certifications can be between $10,000 to $60,000 and requires additional spend every other year or so to pay for surveillance which ensures ongoing certification of your organisation.
The list is long so here are a few of the key ones you should know about.
Payment Card Industry's (PCI) Data Security Standard (DSS) - Requirements and Security Assessment Procedures
The breach or theft of cardholder data affects the entire payment card ecosystem. Customers suddenly lose trust in merchants or financial institutions, their credit can be negatively affected -- there is enormous personal fallout. Merchants and financial institutions lose credibility (and in turn, business), they are also subject to numerous financial liabilities.
The fees to become PCI compliant, and maintain that standing annually, can range from approximately $1,500 AUD annually to over $100,000 AUD annually, depending on the size of your business.
APRA Prudential Standard CPS 234 Information Security
The purpose of CPS 234 is to ensure that APRA-regulated entities have implemented sufficient information security protections.
Information security is no longer considered the sole responsibility of the information technology (IT) team, so CPS 234 requires finance sector organisations to consider the breadth of responsibilities across the organisation and their supply chain.
The cost of compliance depends on the current maturity of your company. If you have a robust information security program in place then it may not take much to complete an audit against the regulation. if you do not then it may cost between $20,000-$100,000 ion consulting and business process improvement to put in place rigorous methods of internal assessment and supply chain governance.
NIST Cybersecurity framework with links to NIST 800-53 - Security and Privacy Controls for Information Systems and Organizations
The NIST CSF comprises a risk-based compilation of guidelines that can help organisations identify, implement, and improve cybersecurity practices, and creates a common language for internal and external communication of cybersecurity issues.
To conduct an assessment against the NIST CSF a risk assessor would typically cost between $10,000 - $50,000 depending on scope.
NIST 800-53 - Security and Privacy Controls for Information Systems and Organizations
U.S Government agencies and their third-party contractors must comply with the Federal Information Security Management Act of 2002 (FISMA)–now the Federal Information Security Modernization Act–which NIST 800-53, Security and Privacy Controls for Federal Information Systems, helps them to do.
Cost of auditing NIST SP implementation can be between $50,00-$200,000 depending on scope.
If the market needs move, such as a regulator requiring regulated entities to perform certain types of audits our advice is to agree internally how you will deal with these demands from clients who are regulated by these requirements and ensure you have an appropriate response. Lean back to your overall strategy and stick to your guns.
If only the lawyers and the sales team have been involved in the contract negotiations, get in the room with the team and their Security team and explain your overall strategy so that they can incorporate reasonable clauses to your agreement that ensure you deliver adequate security controls in line with your own security strategy.
At the helm of our privately owned, global RegTech firm are industry experts who understand that security controls should never get in the way of business growth. We empower companies large and small to remain resilient against potential threats with easily accessible software solutions for implementing information security governance, risk or compliance measures.
We don't just throw a bunch of standards at you and let you try and figure it out! We have designed a thoughtful way of supporting all businesses consider, articulate and develop security controls that suit the needs of the organisation and provide clever reporting capability to allow insights and outcomes from security assessments to be leveraged by the business and shared with third parties.
Our platform places customers at the heart of our design process, while providing access to expert knowledge. With simple navigation and tangible results, we guarantee that all data is securely encrypted at-rest and in transit with no exceptions – meeting international standards with annual security penetration testing and ISO 27001 Certification.
