Cisa Jobs and Profiles

  How do you read a SOC 2 report for quality? And what can you do if it's bad? 𝗥𝗘𝗔𝗗𝗜𝗡𝗚 𝗔 𝗦𝗢𝗖 𝟮 𝗥𝗘𝗣𝗢𝗥𝗧 𝟭. 𝗔𝘂𝗱𝗶𝘁 𝗢𝗽𝗶𝗻𝗶𝗼𝗻 (𝘀𝗲𝗰𝘁𝗶𝗼𝗻 𝟮 𝗼𝗳 𝘁𝗵𝗲 𝗿𝗲𝗽𝗼𝗿𝘁). Quality Signals: → Good: Unqualified Opinion → Bad: A "qualified" opinion means there were problems. 𝟮. 𝗦𝘆𝘀𝘁𝗲𝗺 𝗗𝗲𝘀𝗰𝗿𝗶𝗽𝘁𝗶𝗼𝗻 (𝘀𝗲𝗰𝘁𝗶𝗼𝗻 𝟯 𝗼𝗳 𝘁𝗵𝗲 𝗿𝗲𝗽𝗼𝗿𝘁) Quality Signals: → Good: Provide a lot of detail about the company, product, and security program in a narrative format. →Bad: If it reads like template language that is a red flag. 𝟯. 𝗖𝗼𝗻𝘁𝗿𝗼𝗹𝘀 𝗮𝗻𝗱 𝗧𝗲𝘀𝘁𝗶𝗻𝗴 (𝘀𝗲𝗰𝘁𝗶𝗼𝗻 𝟰 𝗼𝗳 𝘁𝗵𝗲 𝗿𝗲𝗽𝗼𝗿𝘁) Quality Signals: → Good: Look for thorough controls and testing. → Bad: Inquiry only or poorly written test procedures. Missing controls that you would expect to see. 𝟰. 𝗥𝗲𝗽𝗼𝗿𝘁 𝗦𝗰𝗼𝗽𝗲 𝗮𝗻𝗱 𝗔𝘂𝗱𝗶𝘁 𝗣𝗲𝗿𝗶𝗼𝗱 Quality Signals: → Good: Scope matches the system you care about. The audit period is the most re...