SlideShare a Scribd company logo

SOC-2 Framework - Plan, Budget, Design, Integrate & Audit Security Controls

•
•
Mark S. Mahre
Mark S. Mahre

My client Brad Schweizer, COO asked me to create a SOC Framework Diagram (36"x48" poster now hanging in the War Room) to include Terminology, Tasks, Milestones & Personnel to help monitor the implementation progress and more importantly communicate the status to the C-level stakeholders.

1 of 1
Download to read offline
Business Objectives Project Execution & Milestone Tracking Analysis, Strategy, Architecture, Apps & Processes Mapping, Approach & Budgeting Mark S Mahre Service Organization Controls SOC Integration Framework PLANINITIATE Suitability, Remediate & Pre-Testing AUDIT C-Level , Security Officer, Analysts, Subject Matter Experts, Project Managers & Consultants Readiness, Resources & Templates Sponsors Strategy, Requirements & Roadmap Business Case Project Scope Success Criteria HIPPA Req. Road Map Approvals Project Design Project Tasks Risk Assessment As-Is Assessment Financials Scheduling Project Timeline Resource Requirements Gap Analysis Readiness Assessment Create Templates Identify Partnerships SOC Governance HIPPA Mandates Status Reporting Change Controls Authentication Encryption Controls Project Kick-Off Auditor Assessment Employee Awareness Critical Controls System Description Information Security Operational Effectiveness Controls Testing Readiness Reviews Quarterly Meetings Monitor Results Lessons Learned Upload Evidence Audit Procedures Sampling Process SOC Compliance Report Auditor s Letter SOC Gap Letter DESIGN CONTROLS OPERATIONAL Execution, Sustainability & Reporting Risk Mitigations Suitability of Design Data RPO/RTO DR/BCP Strategy Incident Response Cloud Services Mahre & Schweizer Auditor Analysis Testing, Sampling & Fairness Month 1 Month 2 & 3 Month 4 & 5 Month 6 & 7 Month 8 - 11 Month 12 SOC Strategy & Roadmap: Task % Task % Task % Task % Business Case Success Criteria Approval Signoff Project Budget Project Scope of Work Road Map (Milestones) Identify Resources Contact Legal Data Security Mandates HIPPA Mandates Blackout Dates Identify Stakeholders Mapping & Approach: Task % Task % Task % Task % Project Design & Requirements As-Is Assessment (Gaps) Resource Schedule Timeline & Milestones Plan Project Plan & Budgets Project Financials Spreadsheet Contact PMO C-Level Buy-In Risk Assessment Approach Schedule Quarterly Mtg. SOC Status Meeting Schedule Communications Broadcast Readiness & Resources: Task % Task % Task % Task % Confirm Timeline & Milestones To-Be Requirements (Targets) System Description Asset Inventory - CMDB Create Templates People / Resources in Place Information Security Doc. Change Management Strategy Identify Partnerships Readiness Assessment Employee Handbook Building Access Security Plan Analysis, Architecture & Processes: Task % Task % Task % Task % Project Execution Kickoff Change Control Process Meeting HIPPA Mandates AWS Stack Review Aprio Assessment Meeting Critical Controls Accuracy Bi-Weekly Status Reporting End-2-End Data Encryption Employee Training Meeting Security Governance Process Local Area Networks Security Controls Suitability, Remediate & Pre-Testing: Task % Task % Task % Task % Governance Implemented Network Penetration Testing AWS Testing Results Incident Response Testing Critical Controls Testing Client Data Security Testing AWS Monitoring Results DR/BCP Testing Change Controls in Place / Tested LAN/WAN Monitoring Results Data Encryption Results Readiness Reviews Execution, Sustainability & Reporting: Task % Task % Task % Task % Governance Execution Help Desk System in Place Data Encryption Reporting DR/BCP 2018 Plan in Place Critical Controls in Place System Uptime Reporting Client Satisfaction Surveys SOC T2 2018 Planning Change Controls Best Practice Risk Mitigation Strategy 2018 Auditor’s Final Meetings SOC T2 2018 Schedule Testing, Sampling, and Fairness: Task % Task % Task % Task % Uploading to Aprio Shared Drive Critical Controls Priorities Fairness Reporting Complete Lessons Learned Audit Testing Critical Controls Short List SOC Auditor’s Letter Plan for Next Audit Period Audit Sampling Critical Controls Accuracy ‘x’ SOC Compliance Report Build Maturity Model Task Owner: CXO & Leadership CISO CIO COO Legal CFO PMO SOC Team Security Team IT Team Operations Team Contracts Team Finance Team Consultants SOC Framework document created and owned by Mark S Mahre (ClearCost US) and Bradford Schweizer (Aces Health) September 2017.

Recommended

7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 
The Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your StoryThe Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your Story
Priyanka Aash
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
PECB
 
Cybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for ExecutivesCybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for Executives
Krist Davood - Principal - CIO
 
Cybersecurity Metrics: Reporting to BoD
Cybersecurity Metrics: Reporting to BoDCybersecurity Metrics: Reporting to BoD
Cybersecurity Metrics: Reporting to BoD
Pranav Shah
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 

Recommended

7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources7 Steps to Build a SOC with Limited Resources
7 Steps to Build a SOC with Limited Resources
LogRhythm
 
The Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your StoryThe Measure of Success: Security Metrics to Tell Your Story
The Measure of Success: Security Metrics to Tell Your Story
Priyanka Aash
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
Muhammad Sahputra
 
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
PECB
 
Cybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for ExecutivesCybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for Executives
Krist Davood - Principal - CIO
 
Cybersecurity Metrics: Reporting to BoD
Cybersecurity Metrics: Reporting to BoDCybersecurity Metrics: Reporting to BoD
Cybersecurity Metrics: Reporting to BoD
Pranav Shah
 
Security Operation Center - Design & Build
Security Operation Center - Design & BuildSecurity Operation Center - Design & Build
Security Operation Center - Design & Build
Sameer Paradia
 
SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
Priyanka Aash
 
Introduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security FrameworkIntroduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security Framework
PECB
 
SOC-2 Compliance Status Report sample v10.0
SOC-2 Compliance Status Report sample v10.0SOC-2 Compliance Status Report sample v10.0
SOC-2 Compliance Status Report sample v10.0
Mark S. Mahre
 
SOC Certification Runbook Template
SOC Certification Runbook TemplateSOC Certification Runbook Template
SOC Certification Runbook Template
Mark S. Mahre
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
Technology Alignment Framework
Technology Alignment FrameworkTechnology Alignment Framework
Technology Alignment Framework
Mark S. Mahre
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
Elliott Franklin
 
Introduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity FrameworkIntroduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity Framework
Tuan Phan
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program
BeyondTrust
 
Security and Compliance
Security and ComplianceSecurity and Compliance
Security and Compliance
Amazon Web Services
 
Lessons Learned from the NIST CSF
Lessons Learned from the NIST CSFLessons Learned from the NIST CSF
Lessons Learned from the NIST CSF
Digital Bond
 
Iso27001 The Road To Certification
Iso27001 The Road To CertificationIso27001 The Road To Certification
Iso27001 The Road To Certificationtschraider
 
Cybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your OrganizationCybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your Organization
McKonly & Asbury, LLP
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
Conceptual security architecture
Conceptual security architectureConceptual security architecture
Conceptual security architecture
MubashirAslam5
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
Security & Compliance
Security & ComplianceSecurity & Compliance
Security & Compliance
Amazon Web Services
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
Shah Sheikh
 
Cyber Security Incident Response
Cyber Security Incident ResponseCyber Security Incident Response
Cyber Security Incident Response
PECB
 
KTern - The Best product for SAP S/4HANA Conversion
KTern - The Best product for SAP S/4HANA ConversionKTern - The Best product for SAP S/4HANA Conversion
KTern - The Best product for SAP S/4HANA Conversion
Akilesh Kumaran
 
Remade Slides.pptx
Remade Slides.pptxRemade Slides.pptx
Remade Slides.pptx
AshokKumar705948
 

More Related Content

What's hot

SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
Priyanka Aash
 
Introduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security FrameworkIntroduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security Framework
PECB
 
SOC-2 Compliance Status Report sample v10.0
SOC-2 Compliance Status Report sample v10.0SOC-2 Compliance Status Report sample v10.0
SOC-2 Compliance Status Report sample v10.0
Mark S. Mahre
 
SOC Certification Runbook Template
SOC Certification Runbook TemplateSOC Certification Runbook Template
SOC Certification Runbook Template
Mark S. Mahre
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
Ahmed Ayman
 
Technology Alignment Framework
Technology Alignment FrameworkTechnology Alignment Framework
Technology Alignment Framework
Mark S. Mahre
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
Elliott Franklin
 
Introduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity FrameworkIntroduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity Framework
Tuan Phan
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program
BeyondTrust
 
Security and Compliance
Security and ComplianceSecurity and Compliance
Security and Compliance
Amazon Web Services
 
Lessons Learned from the NIST CSF
Lessons Learned from the NIST CSFLessons Learned from the NIST CSF
Lessons Learned from the NIST CSF
Digital Bond
 
Iso27001 The Road To Certification
Iso27001 The Road To CertificationIso27001 The Road To Certification
Iso27001 The Road To Certificationtschraider
 
Cybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your OrganizationCybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your Organization
McKonly & Asbury, LLP
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
Conceptual security architecture
Conceptual security architectureConceptual security architecture
Conceptual security architecture
MubashirAslam5
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
Priyanka Aash
 
Security & Compliance
Security & ComplianceSecurity & Compliance
Security & Compliance
Amazon Web Services
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
Shah Sheikh
 
Cyber Security Incident Response
Cyber Security Incident ResponseCyber Security Incident Response
Cyber Security Incident Response
PECB
 

What's hot (20)

SOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOCSOC Architecture - Building the NextGen SOC
SOC Architecture - Building the NextGen SOC
 
Introduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security FrameworkIntroduction to Risk Management via the NIST Cyber Security Framework
Introduction to Risk Management via the NIST Cyber Security Framework
 
SOC-2 Compliance Status Report sample v10.0
SOC-2 Compliance Status Report sample v10.0SOC-2 Compliance Status Report sample v10.0
SOC-2 Compliance Status Report sample v10.0
 
SOC Certification Runbook Template
SOC Certification Runbook TemplateSOC Certification Runbook Template
SOC Certification Runbook Template
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
 
Security operation center (SOC)
Security operation center (SOC)Security operation center (SOC)
Security operation center (SOC)
 
Technology Alignment Framework
Technology Alignment FrameworkTechnology Alignment Framework
Technology Alignment Framework
 
Building an effective Information Security Roadmap
Building an effective Information Security RoadmapBuilding an effective Information Security Roadmap
Building an effective Information Security Roadmap
 
Introduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity FrameworkIntroduction to NIST Cybersecurity Framework
Introduction to NIST Cybersecurity Framework
 
10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program10 Steps to Building an Effective Vulnerability Management Program
10 Steps to Building an Effective Vulnerability Management Program
 
Security and Compliance
Security and ComplianceSecurity and Compliance
Security and Compliance
 
Lessons Learned from the NIST CSF
Lessons Learned from the NIST CSFLessons Learned from the NIST CSF
Lessons Learned from the NIST CSF
 
Iso27001 The Road To Certification
Iso27001 The Road To CertificationIso27001 The Road To Certification
Iso27001 The Road To Certification
 
Cybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your OrganizationCybersecurity Risk Management Program and Your Organization
Cybersecurity Risk Management Program and Your Organization
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
Conceptual security architecture
Conceptual security architectureConceptual security architecture
Conceptual security architecture
 
SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1SOC Architecture Workshop - Part 1
SOC Architecture Workshop - Part 1
 
Security & Compliance
Security & ComplianceSecurity & Compliance
Security & Compliance
 
DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)DTS Solution - Building a SOC (Security Operations Center)
DTS Solution - Building a SOC (Security Operations Center)
 
Cyber Security Incident Response
Cyber Security Incident ResponseCyber Security Incident Response
Cyber Security Incident Response
 

Similar to SOC-2 Framework - Plan, Budget, Design, Integrate & Audit Security Controls

KTern - The Best product for SAP S/4HANA Conversion
KTern - The Best product for SAP S/4HANA ConversionKTern - The Best product for SAP S/4HANA Conversion
KTern - The Best product for SAP S/4HANA Conversion
Akilesh Kumaran
 
Remade Slides.pptx
Remade Slides.pptxRemade Slides.pptx
Remade Slides.pptx
AshokKumar705948
 
Triple Constraints of Projects: Scope, Cost & Schedule
Triple Constraints of Projects: Scope, Cost & ScheduleTriple Constraints of Projects: Scope, Cost & Schedule
Triple Constraints of Projects: Scope, Cost & Scheduleshofiulalom
 
Application Management Services
Application Management ServicesApplication Management Services
Application Management Services
Gss America
 
Application Management Services
Application Management ServicesApplication Management Services
Application Management Services
venu1506
 
Application Management Service Offerings
Application Management Service OfferingsApplication Management Service Offerings
Application Management Service Offerings
Gss America
 
GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...
GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...
GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...
LN Mishra CBAP
 
20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution
20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution
20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution
Craeg Strong
 
QAS 2015 Overview Abbreviated Deck
QAS 2015 Overview Abbreviated DeckQAS 2015 Overview Abbreviated Deck
QAS 2015 Overview Abbreviated DeckDaniel Goodstein
 
Seioglobal Profile
Seioglobal ProfileSeioglobal Profile
Seioglobal Profile
Michael S.
 
Brad Hipps: Mastering the Modern Application Lifecycle
Brad Hipps: Mastering the Modern Application LifecycleBrad Hipps: Mastering the Modern Application Lifecycle
Brad Hipps: Mastering the Modern Application LifecycleSoftware Guru
 
In sync10 grc_suite
In sync10 grc_suiteIn sync10 grc_suite
In sync10 grc_suite
InSync Conference
 
Sage Solutions Brief.Mjo
Sage Solutions Brief.MjoSage Solutions Brief.Mjo
Sage Solutions Brief.Mjomjo57
 
Project Management
Project ManagementProject Management
Project Managementjdhakkan
 
PMP CAPM Study Guide Time Management
PMP CAPM Study Guide Time ManagementPMP CAPM Study Guide Time Management
PMP CAPM Study Guide Time Management
Ahmed Higazi, PMP CSM
 
Software Infrastructure requirements elicitation and design roadmap - Innovat...
Software Infrastructure requirements elicitation and design roadmap - Innovat...Software Infrastructure requirements elicitation and design roadmap - Innovat...
Software Infrastructure requirements elicitation and design roadmap - Innovat...
Innovate Vancouver
 
Ms Dynamics Sure Step 2010
Ms Dynamics Sure Step 2010Ms Dynamics Sure Step 2010
Ms Dynamics Sure Step 2010Mohamed Aamer
 
20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners
20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners
20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners
Craeg Strong
 
Managed it services
Managed it servicesManaged it services
Managed it services
Gss America
 

Similar to SOC-2 Framework - Plan, Budget, Design, Integrate & Audit Security Controls (20)

KTern - The Best product for SAP S/4HANA Conversion
KTern - The Best product for SAP S/4HANA ConversionKTern - The Best product for SAP S/4HANA Conversion
KTern - The Best product for SAP S/4HANA Conversion
 
Remade Slides.pptx
Remade Slides.pptxRemade Slides.pptx
Remade Slides.pptx
 
Triple Constraints of Projects: Scope, Cost & Schedule
Triple Constraints of Projects: Scope, Cost & ScheduleTriple Constraints of Projects: Scope, Cost & Schedule
Triple Constraints of Projects: Scope, Cost & Schedule
 
Application Management Services
Application Management ServicesApplication Management Services
Application Management Services
 
Application Management Services
Application Management ServicesApplication Management Services
Application Management Services
 
Application Management Service Offerings
Application Management Service OfferingsApplication Management Service Offerings
Application Management Service Offerings
 
GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...
GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...
GRCPerfect - Enterprise Project Governance, Risk and Compliance Management Sy...
 
20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution
20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution
20200429 PMI NYC Meetup Agile Governance Ariel Partners for Distribution
 
QAS 2015 Overview Abbreviated Deck
QAS 2015 Overview Abbreviated DeckQAS 2015 Overview Abbreviated Deck
QAS 2015 Overview Abbreviated Deck
 
Seioglobal Profile
Seioglobal ProfileSeioglobal Profile
Seioglobal Profile
 
Brad Hipps: Mastering the Modern Application Lifecycle
Brad Hipps: Mastering the Modern Application LifecycleBrad Hipps: Mastering the Modern Application Lifecycle
Brad Hipps: Mastering the Modern Application Lifecycle
 
In sync10 grc_suite
In sync10 grc_suiteIn sync10 grc_suite
In sync10 grc_suite
 
Sage Solutions Brief.Mjo
Sage Solutions Brief.MjoSage Solutions Brief.Mjo
Sage Solutions Brief.Mjo
 
Project Management
Project ManagementProject Management
Project Management
 
PMP CAPM Study Guide Time Management
PMP CAPM Study Guide Time ManagementPMP CAPM Study Guide Time Management
PMP CAPM Study Guide Time Management
 
Datacenter
DatacenterDatacenter
Datacenter
 
Software Infrastructure requirements elicitation and design roadmap - Innovat...
Software Infrastructure requirements elicitation and design roadmap - Innovat...Software Infrastructure requirements elicitation and design roadmap - Innovat...
Software Infrastructure requirements elicitation and design roadmap - Innovat...
 
Ms Dynamics Sure Step 2010
Ms Dynamics Sure Step 2010Ms Dynamics Sure Step 2010
Ms Dynamics Sure Step 2010
 
20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners
20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners
20200205 DHS Agile Center of Excellence Agile Governance Ariel Partners
 
Managed it services
Managed it servicesManaged it services
Managed it services
 

More from Mark S. Mahre

Technology Assessment Framework
Technology Assessment FrameworkTechnology Assessment Framework
Technology Assessment Framework
Mark S. Mahre
 
Aprio Consulting Services - Cloud, ITFM, Compliance, Innovation, Technology
Aprio Consulting Services - Cloud, ITFM, Compliance, Innovation, TechnologyAprio Consulting Services - Cloud, ITFM, Compliance, Innovation, Technology
Aprio Consulting Services - Cloud, ITFM, Compliance, Innovation, Technology
Mark S. Mahre
 
Governance - Project Management Office Professional Services
Governance - Project Management Office Professional ServicesGovernance - Project Management Office Professional Services
Governance - Project Management Office Professional Services
Mark S. Mahre
 
US State Government Case Study
US State Government Case StudyUS State Government Case Study
US State Government Case Study
Mark S. Mahre
 
ClearCost License & Implementation under $50K
ClearCost License & Implementation under $50KClearCost License & Implementation under $50K
ClearCost License & Implementation under $50K
Mark S. Mahre
 
ClearCost
ClearCostClearCost
ClearCost
Mark S. Mahre
 
VP Reference Letter_Oct2015
VP Reference Letter_Oct2015VP Reference Letter_Oct2015
VP Reference Letter_Oct2015Mark S. Mahre
 
CFO Reference Letter_Sept2015
CFO Reference Letter_Sept2015CFO Reference Letter_Sept2015
CFO Reference Letter_Sept2015Mark S. Mahre
 
ClearCost Introduction 2015
ClearCost Introduction 2015ClearCost Introduction 2015
ClearCost Introduction 2015
Mark S. Mahre
 
Mark S Mahre - Info-Tech final
Mark S Mahre - Info-Tech finalMark S Mahre - Info-Tech final
Mark S Mahre - Info-Tech finalMark S. Mahre
 
Spending Request Example V4
Spending Request Example V4Spending Request Example V4
Spending Request Example V4Mark S. Mahre
 
IT Dashboard User Manual V2.2
IT Dashboard User Manual V2.2IT Dashboard User Manual V2.2
IT Dashboard User Manual V2.2Mark S. Mahre
 
Capacity Management Process Handbook
Capacity Management Process HandbookCapacity Management Process Handbook
Capacity Management Process HandbookMark S. Mahre
 
PMO Framework Corus360 V2B
PMO Framework Corus360 V2BPMO Framework Corus360 V2B
PMO Framework Corus360 V2BMark S. Mahre
 
Data Migrations Framework V33
Data Migrations Framework V33Data Migrations Framework V33
Data Migrations Framework V33Mark S. Mahre
 
FundFlow V3.6 Overview (Printable) 08-18-03
FundFlow V3.6 Overview (Printable) 08-18-03FundFlow V3.6 Overview (Printable) 08-18-03
FundFlow V3.6 Overview (Printable) 08-18-03Mark S. Mahre
 
Enterprise Project Process Diagram May 2010
Enterprise Project Process Diagram May 2010Enterprise Project Process Diagram May 2010
Enterprise Project Process Diagram May 2010Mark S. Mahre
 

More from Mark S. Mahre (17)

Technology Assessment Framework
Technology Assessment FrameworkTechnology Assessment Framework
Technology Assessment Framework
 
Aprio Consulting Services - Cloud, ITFM, Compliance, Innovation, Technology
Aprio Consulting Services - Cloud, ITFM, Compliance, Innovation, TechnologyAprio Consulting Services - Cloud, ITFM, Compliance, Innovation, Technology
Aprio Consulting Services - Cloud, ITFM, Compliance, Innovation, Technology
 
Governance - Project Management Office Professional Services
Governance - Project Management Office Professional ServicesGovernance - Project Management Office Professional Services
Governance - Project Management Office Professional Services
 
US State Government Case Study
US State Government Case StudyUS State Government Case Study
US State Government Case Study
 
ClearCost License & Implementation under $50K
ClearCost License & Implementation under $50KClearCost License & Implementation under $50K
ClearCost License & Implementation under $50K
 
ClearCost
ClearCostClearCost
ClearCost
 
VP Reference Letter_Oct2015
VP Reference Letter_Oct2015VP Reference Letter_Oct2015
VP Reference Letter_Oct2015
 
CFO Reference Letter_Sept2015
CFO Reference Letter_Sept2015CFO Reference Letter_Sept2015
CFO Reference Letter_Sept2015
 
ClearCost Introduction 2015
ClearCost Introduction 2015ClearCost Introduction 2015
ClearCost Introduction 2015
 
Mark S Mahre - Info-Tech final
Mark S Mahre - Info-Tech finalMark S Mahre - Info-Tech final
Mark S Mahre - Info-Tech final
 
Spending Request Example V4
Spending Request Example V4Spending Request Example V4
Spending Request Example V4
 
IT Dashboard User Manual V2.2
IT Dashboard User Manual V2.2IT Dashboard User Manual V2.2
IT Dashboard User Manual V2.2
 
Capacity Management Process Handbook
Capacity Management Process HandbookCapacity Management Process Handbook
Capacity Management Process Handbook
 
PMO Framework Corus360 V2B
PMO Framework Corus360 V2BPMO Framework Corus360 V2B
PMO Framework Corus360 V2B
 
Data Migrations Framework V33
Data Migrations Framework V33Data Migrations Framework V33
Data Migrations Framework V33
 
FundFlow V3.6 Overview (Printable) 08-18-03
FundFlow V3.6 Overview (Printable) 08-18-03FundFlow V3.6 Overview (Printable) 08-18-03
FundFlow V3.6 Overview (Printable) 08-18-03
 
Enterprise Project Process Diagram May 2010
Enterprise Project Process Diagram May 2010Enterprise Project Process Diagram May 2010
Enterprise Project Process Diagram May 2010
 

Recently uploaded

April 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products NewsletterApril 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products Newsletter
NathanBaughman3
 
一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理
一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理
一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理
taqyed
 
5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer
ofm712785
 
Global Interconnection Group Joint Venture[960] (1).pdf
Global Interconnection Group Joint Venture[960] (1).pdfGlobal Interconnection Group Joint Venture[960] (1).pdf
Global Interconnection Group Joint Venture[960] (1).pdf
Henry Tapper
 
BeMetals Presentation_May_22_2024 .pdf
BeMetals Presentation_May_22_2024 .pdfBeMetals Presentation_May_22_2024 .pdf
BeMetals Presentation_May_22_2024 .pdf
DerekIwanaka1
 
Enterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdfEnterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdf
KaiNexus
 
The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...
awaisafdar
 
What is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdfWhat is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdf
seoforlegalpillers
 
Unveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdfUnveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdf
Sam H
 
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
Kumar Satyam
 
Sustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & EconomySustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & Economy
Operational Excellence Consulting
 
20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf
tjcomstrang
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
BBPMedia1
 
Filing Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed GuideFiling Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed Guide
YourLegal Accounting
 
Cracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptxCracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptx
Workforce Group
 
Lookback Analysis
Lookback AnalysisLookback Analysis
Lookback Analysis
Safe PaaS
 
3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx
tanyjahb
 
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBdCree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
creerey
 
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
PaulBryant58
 
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdfMeas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
dylandmeas
 

Recently uploaded (20)

April 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products NewsletterApril 2024 Nostalgia Products Newsletter
April 2024 Nostalgia Products Newsletter
 
一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理
一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理
一比一原版加拿大渥太华大学毕业证（uottawa毕业证书）如何办理
 
5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer5 Things You Need To Know Before Hiring a Videographer
5 Things You Need To Know Before Hiring a Videographer
 
Global Interconnection Group Joint Venture[960] (1).pdf
Global Interconnection Group Joint Venture[960] (1).pdfGlobal Interconnection Group Joint Venture[960] (1).pdf
Global Interconnection Group Joint Venture[960] (1).pdf
 
BeMetals Presentation_May_22_2024 .pdf
BeMetals Presentation_May_22_2024 .pdfBeMetals Presentation_May_22_2024 .pdf
BeMetals Presentation_May_22_2024 .pdf
 
Enterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdfEnterprise Excellence is Inclusive Excellence.pdf
Enterprise Excellence is Inclusive Excellence.pdf
 
The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...The Parable of the Pipeline a book every new businessman or business student ...
The Parable of the Pipeline a book every new businessman or business student ...
 
What is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdfWhat is the TDS Return Filing Due Date for FY 2024-25.pdf
What is the TDS Return Filing Due Date for FY 2024-25.pdf
 
Unveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdfUnveiling the Secrets How Does Generative AI Work.pdf
Unveiling the Secrets How Does Generative AI Work.pdf
 
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
India Orthopedic Devices Market: Unlocking Growth Secrets, Trends and Develop...
 
Sustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & EconomySustainability: Balancing the Environment, Equity & Economy
Sustainability: Balancing the Environment, Equity & Economy
 
20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf20240425_ TJ Communications Credentials_compressed.pdf
20240425_ TJ Communications Credentials_compressed.pdf
 
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
RMD24 | Debunking the non-endemic revenue myth Marvin Vacquier Droop | First ...
 
Filing Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed GuideFiling Your Delaware Franchise Tax A Detailed Guide
Filing Your Delaware Franchise Tax A Detailed Guide
 
Cracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptxCracking the Workplace Discipline Code Main.pptx
Cracking the Workplace Discipline Code Main.pptx
 
Lookback Analysis
Lookback AnalysisLookback Analysis
Lookback Analysis
 
3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx3.0 Project 2_ Developing My Brand Identity Kit.pptx
3.0 Project 2_ Developing My Brand Identity Kit.pptx
 
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBdCree_Rey_BrandIdentityKit.PDF_PersonalBd
Cree_Rey_BrandIdentityKit.PDF_PersonalBd
 
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
Accpac to QuickBooks Conversion Navigating the Transition with Online Account...
 
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdfMeas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
Meas_Dylan_DMBS_PB1_2024-05XX_Revised.pdf
 

SOC-2 Framework - Plan, Budget, Design, Integrate & Audit Security Controls

  • 1. Business Objectives Project Execution & Milestone Tracking Analysis, Strategy, Architecture, Apps & Processes Mapping, Approach & Budgeting Mark S Mahre Service Organization Controls SOC Integration Framework PLANINITIATE Suitability, Remediate & Pre-Testing AUDIT C-Level , Security Officer, Analysts, Subject Matter Experts, Project Managers & Consultants Readiness, Resources & Templates Sponsors Strategy, Requirements & Roadmap Business Case Project Scope Success Criteria HIPPA Req. Road Map Approvals Project Design Project Tasks Risk Assessment As-Is Assessment Financials Scheduling Project Timeline Resource Requirements Gap Analysis Readiness Assessment Create Templates Identify Partnerships SOC Governance HIPPA Mandates Status Reporting Change Controls Authentication Encryption Controls Project Kick-Off Auditor Assessment Employee Awareness Critical Controls System Description Information Security Operational Effectiveness Controls Testing Readiness Reviews Quarterly Meetings Monitor Results Lessons Learned Upload Evidence Audit Procedures Sampling Process SOC Compliance Report Auditor s Letter SOC Gap Letter DESIGN CONTROLS OPERATIONAL Execution, Sustainability & Reporting Risk Mitigations Suitability of Design Data RPO/RTO DR/BCP Strategy Incident Response Cloud Services Mahre & Schweizer Auditor Analysis Testing, Sampling & Fairness Month 1 Month 2 & 3 Month 4 & 5 Month 6 & 7 Month 8 - 11 Month 12 SOC Strategy & Roadmap: Task % Task % Task % Task % Business Case Success Criteria Approval Signoff Project Budget Project Scope of Work Road Map (Milestones) Identify Resources Contact Legal Data Security Mandates HIPPA Mandates Blackout Dates Identify Stakeholders Mapping & Approach: Task % Task % Task % Task % Project Design & Requirements As-Is Assessment (Gaps) Resource Schedule Timeline & Milestones Plan Project Plan & Budgets Project Financials Spreadsheet Contact PMO C-Level Buy-In Risk Assessment Approach Schedule Quarterly Mtg. SOC Status Meeting Schedule Communications Broadcast Readiness & Resources: Task % Task % Task % Task % Confirm Timeline & Milestones To-Be Requirements (Targets) System Description Asset Inventory - CMDB Create Templates People / Resources in Place Information Security Doc. Change Management Strategy Identify Partnerships Readiness Assessment Employee Handbook Building Access Security Plan Analysis, Architecture & Processes: Task % Task % Task % Task % Project Execution Kickoff Change Control Process Meeting HIPPA Mandates AWS Stack Review Aprio Assessment Meeting Critical Controls Accuracy Bi-Weekly Status Reporting End-2-End Data Encryption Employee Training Meeting Security Governance Process Local Area Networks Security Controls Suitability, Remediate & Pre-Testing: Task % Task % Task % Task % Governance Implemented Network Penetration Testing AWS Testing Results Incident Response Testing Critical Controls Testing Client Data Security Testing AWS Monitoring Results DR/BCP Testing Change Controls in Place / Tested LAN/WAN Monitoring Results Data Encryption Results Readiness Reviews Execution, Sustainability & Reporting: Task % Task % Task % Task % Governance Execution Help Desk System in Place Data Encryption Reporting DR/BCP 2018 Plan in Place Critical Controls in Place System Uptime Reporting Client Satisfaction Surveys SOC T2 2018 Planning Change Controls Best Practice Risk Mitigation Strategy 2018 Auditor’s Final Meetings SOC T2 2018 Schedule Testing, Sampling, and Fairness: Task % Task % Task % Task % Uploading to Aprio Shared Drive Critical Controls Priorities Fairness Reporting Complete Lessons Learned Audit Testing Critical Controls Short List SOC Auditor’s Letter Plan for Next Audit Period Audit Sampling Critical Controls Accuracy ‘x’ SOC Compliance Report Build Maturity Model Task Owner: CXO & Leadership CISO CIO COO Legal CFO PMO SOC Team Security Team IT Team Operations Team Contracts Team Finance Team Consultants SOC Framework document created and owned by Mark S Mahre (ClearCost US) and Bradford Schweizer (Aces Health) September 2017.