Search
    AssuranceLab
    AssuranceLab
    Admin

    About

    Effective Vendor Management Process

    Third-party vendors have a critical role in improving an organisation's operational efficiency and capabilities. Organisations can focus on their core...
    3 min Read

    Our growing list of supported compliance accreditations
    4 min Read

    Essential Steps and Requirements for SOC 2 Compliance

    SOC 2 reports are independent assessments conducted by certified public accounting firms or other qualified auditors. These reports provide a level of...
    2 min Read

    Hear from our team on some recent audit engagements for trailblazing clients

    At AssuranceLab, we love helping our visionary clients achieve their compliance goals, and celebrating their wins with them!
    3 min Read

    Our alliance with Drata

    The audit and compliance ecosystem has become a jungle of varying compliance platform and audit firm alliances. Our alliance with Drata unlocks great...
    6 min Read

    The three parts to a compliance program

    We see vastly different parts making up the compliance programs in our clients, but they ALL include three key components.
    2 min Read

    Access reviews simplified

    Access reviews shouldn't take hundreds of thousands of hours. If they do, it's time to look at a better risk-based approach.
    6 min Read

    Our SOC 2 and what it means

    In November 2022, we released our SOC 2 Type I report to demonstrate our commitment to securing our clients sensitive information assets.
    4 min Read

    The overlap of APRA and global standards

    When you're a licensed financial service provider in Australia, or even just selling your software/services to those providers, APRA regulations come...
    4 min Read

    The timeline, the steps, and what’s involved for compliance

    When planning for your compliance goals, you'll want to understand the timeline, steps, and actual activities before diving right in.
    3 min Read

    Comparing SOC 2 and ISO 27001 in practice

    The two most common globally recognised, cross-industry, information security standards, are SOC 2 and ISO 27001. Despite about 80% overlap in what...
    4 min Read

    How we're different: Our 10 value props

    Our software and audit services combination has been iterated and refined over the last four years. There's 10 key value differentiators in our...
    3 min Read

    SOC 1: Defining the Objectives

    SOC 1 is a standard that can be confusing; why would the company get to define its own criteria, or “control objectives”, for achieving the SOC 1...
    3 min Read

    Our ESG Framework for Reporting

    There are lots of ESG standards out there, so why did we create our own?
    5 min Read

    10 Compliance Standards to Consider

    You might start out by asking; which compliance standard is best for us? But once you explore the realm of standards, it's common to land on more than...
    6 min Read

    What to expect in the ACCC accreditation process?

    Many of our clients push hard and fast to achieve compliance, complete their audit, and submit their CDR application to the ACCC to get accredited....
    3 min Read

    A practical guide to endpoint device controls and BYOD

    Bring-your-own-device is a common policy for startups. You may want to save costs, reduce waste/duplication, and/or give their people more flexibility...
    3 min Read

    When is the right time to implement a HRIS?

    A human resources information system (HRIS) can be a huge boost to startups and compliance programs. But when is the right time to implement one?
    3 min Read

    What’s the difference between security, privacy and confidentiality?

    Data security, privacy and confidentiality have always co-existed as important topics in their own right and as related concepts. The average person...
    3 min Read

    Five easy steps to implement polices that fit

    Documenting policies has always been a major pain point of companies working towards compliance. It can be a lot of work!
    3 min Read

    The Definitive Guide to GDPR

    If you’ve customers or users in Europe, you probably know of GDPR. It’s that thing, that’s significant, with potential fines, and that your enterprise...
    3 min Read

    Audit ready in minutes: here’s how agile audits work

    Preparing for audits and compliance with standards like SOC 2 and ISO 27001, used to be an activity that took several months. That could be shortened...
    3 min Read

    Blending standards: why it's the new and better way

    There’s a lot of overlap between compliance standards, and often multiple are needed. So blending them together makes a lot of sense! How does that...
    4 min Read

    Generic vs. tailored audits: what’s the difference?

    Generic audits, also referred to as bundled audits, platform-trained auditors, out-of-the-box or pre-built control sets, are an approach to audits...
    4 min Read

    HIPAA Compliance three ways

    HIPAA is a healthcare data protection regulation; that’s mandatory to comply with and has optional attestations to satisfy enterprise customers.
    2 min Read

    CSA STAR: What you need to know

    Cloud Security Alliance covers modern cloud security practices to address a broad set of expectations and requirements of your enterprise customers.
    3 min Read

    SOC 2 + Options

    SOC 2 + is growing in popularity to combine a commonly accepted information security standard with other specific requirements.
    3 min Read

    Software for Compliance

    What's the best way to leverage software for your compliance? This is the hot topic that's shaping the compliance industry.
    3 min Read

    Becoming a Certified B-Corp

    We’ve had a few questions about our B-Corp certification; why do it? How does it work? What does it actually involve? 🙋‍♀️
    4 min Read

    The five reasons startups go for security certifications

    Security and compliance qualifications, like SOC 2 and ISO 27001, demonstrate that you apply good practices in your business.
    3 min Read

    Practical tips from six successful compliance projects

    Our clients have worked through the daunting and challenging task of achieving compliance with global security standards like SOC 2 and ISO 27001.
    4 min Read

    Best Practices: Business Continuity & Disaster Recovery

    Business continuity planning (BCP) and disaster recovery (DR) are all about preparing for and responding to major adverse events.
    6 min Read

    Managing Controls: Continuous

    Continuous controls are systematic or design functions that once implemented, continuously apply in practice.
    2 min Read

    InfoSec Automation: The Definitive Guide

    The topical focus in InfoSec compliance and assurance standards, is automation. How do you implement your control practices in a systematic way that...
    3 min Read

    Auditor selection checklist: 10 things to consider

    When selecting an audit provider there’s 10 important things to consider that aren’t obvious to those that haven't been through audits before.
    4 min Read

    Managing Controls: Periodic

    Periodic controls are the meetings, reviews and other activities that are performed at regular intervals.
    3 min Read

    Managing Controls: Event-Based

    Event-based controls are performed in conjunction with ad-hoc events that occur; new employees, incidents, and change releases, for example.
    4 min Read

    Straight to SOC 2 Type 2

    While we recommend a Type 1 prior to Type 2, we've conceded straight to Type 2 is a growing preference. Our focus has shifted to how we can enable it!
    4 min Read

    'Process-Light' SOC 2

    As the leading provider of SOC 2 reports to small-mid size cloud services businesses in Asia-Pacific, we get a lot of questions about how to achieve...
    4 min Read

    The five reasons clients choose AssuranceLab

    AssuranceLab has set a new standard in SOC 2 information security compliance. Through innovation, relentless focus on our clients experience, and...
    3 min Read

    Our story

    Over the last three years, AssuranceLab has become the leading provider of SOC 2 in Australia and New Zealand. Like our startup business clients, our...
    6 min Read

    The four functions of security and compliance software

    A game-changer in the information security and compliance industry has been the rise of software automation.
    3 min Read

    The five drivers of information security 'compliance' in 2021

    Information security compliance had a big year in 2020. When the pandemic lock downs came into effect, it put remote working practices to the test. The...
    3 min Read

    Best Practices: templates or self-created policies, procedures & plans?

    We see a lot of customers ask about policy templates to solve the various requirements of Infosec. It makes sense; why start from scratch or re-invent...
    2 min Read

    Best Practices: Change Communications

    When changes are made to your system, it's important to consider and communicate any InfoSec related implications.
    4 min Read

    Why Issue a SOC 3 Report?

    SOC 3 is often overlooked; caused by common misconceptions. What is it and why would you issue SOC 3?
    2 min Read

    Best practices: Governance

    Governance ensures your company operates effectively in alignment to your objectives.
    3 min Read

    Best practices: Management Meetings

    What should management meetings cover? What if you don’t have a Board of Directors?
    3 min Read

    Best practices: Software Development

    The software development cycle is all about making sure changes to your system(s) are high quality, appropriate, and protect the system integrity and...
    4 min Read

    Best Practices: Customer Communications

    Customer communications may sound like an obvious and simple concept; but it's not. It often breaks down in practice.
    4 min Read

    SOC 2: The 5 Trust Services Categories

    The SOC 2 audit, which can help demonstrate an organisation's commitment to protecting customer data, provides a level of flexibility that is unique...
    2 min Read

    SOC 2: Solving compliance with one standard

    There’s a reason we almost always recommend SOC 2 as the solution to your compliance requirements.
    3 min Read

    Best practices: Confidentiality

    We all know confidentiality as the simple concept of keeping sensitive information, secret. That is, limiting who has access to it to a small number of...
    2 min Read

    Best practices: Vendor Risk Management

    Vendor risk management is one of those areas you can go right down the rabbit hole and lose sight of why you’re doing it in the first place!
    4 min Read

    SOC 1, SOC 2, or ASAE 3150 for CDR Accreditation?

    The CDR accreditation requires an independently audited SOC report to demonstrate the minimum set of information security controls.

    4 min Read

    ISO 27001 Stamped Inadequate for Open Banking

    In a major blow to ISO 27001, the Consumer Data Right for Open Banking has ruled it insufficient for the infosec accreditation requirements.

    2 min Read

    Best Practices: User Access Controls

    User access controls are a group of administration practices that restricts access to the systems, to only those that require access.

    3 min Read

    Best Practices: the Product Backlog

    The product backlog needs to balance functional and non-functional requirements. How do you ensure it's an appropriate mix?

    4 min Read

    7 Tips for Using Your SOC 2 Report

    You've done the hard work achieving SOC 2. It's time to get value from your investment. How do you communicate this achievement?

    3 min Read

    Automating SOC 2

    It's amazing how many products "automate SOC 2". Many of these solutions are highly effective. None of them "automate SOC 2". Here's why.

    2 min Read

    Six Reasons to do SOC Type 1 Reports First

    There's five reasons to obtain a Type 1 report prior to Type 2 report, when it comes to SOC 1 or SOC 2 reporting.

    4 min Read

    SOC 2: Cybersecurity by Accountants

    Why is a security standard is issued and maintained by an accountancy body? What does the AICPA know about cybersecurity?

    2 min Read

    Boundaries of the System

    Your data is hosted by your outsourced infrastructure provider, or maybe you don't even collect any sensitive data. Why do you need a SOC 2?

    2 min Read

    The 7 Steps to SOC 2

    Reach new business opportunities and close deals faster, with 7 steps to achieve SOC 2!

    3 min Read

    SOC 2 vs. ISO 27001

    SOC 2 & ISO 27001 are the leading standards to provide assurance to customers. They have a very similar focus, but differ in practice...

    4 min Read

    The SOC "Levels"

    SOC 1, SOC 2, Type 1, Type 2 - It's easy to get confused between these terms. What do they mean? What's the difference?

    2 min Read

    Best Practices: Risk Management

    The lack of a defined risk management process, is by far the main "control gap" we see. What is risk management? How do you implement it?

    4 min Read

    How to Pass Your SOC Audit

    Everyone wants the silver bullet for SOC 2. We don't have that, but our tips can ensure you are well set up for success!

    2 min Read

    SOC 2: Introduction

    Have you been asked for a SOC 2 and left wondering what that means?You're not alone, we get that question all the time. Let us explain.

    6 min Read

    SOC 2 Scope: How It’s Defined

    Have you been asked what your SOC 2 scope is? Our clients are often confused by this question. We explore what it means and how it works.

    3 min Read

    What does a SOC 2 Cost?

    How much should you be paying for your SOC 2 report(s)? What are the drivers of the cost?

    3 min Read

    SOC 2 FAQ

    We get all sorts of weird and wonderful questions about SOC 2. We explore the common ones in this FAQ.

    5 min Read

    The 4 Control Concepts

    The term "control" can be confusing. It's just the business practices that support your objectives. There's four concepts you should know.

    4 min Read
    All posts