Week 5 part 1 Flashcards

Question

Cotrols-AICPA

Answer 1

SAS70 satement on auditing standard number 70 devleoped by the AICPA was an autit standat for mesuring a data center fiancial reporting and recordkeepign controls SSAE 16-statment on standards for attestation engament -AICIPA auding standarding for reporting on cotnrals at service organization includin gdata centers in the unites goes beyon sas 70 by requireing the audiot to obtain a written asserion from managment ragarting the desing and operating effective of the control being reviewed. also prvides better alignment with interantional audit stadanrd ISAE3402 SAS 70 (Replaced in June 2011) - **What it was:** SAS 70 was an auditing standard created by the AICPA (American Institute of CPAs) to evaluate how well data centers managed their financial reporting and record-keeping. SSAE 16 - **What it is:** SSAE 16 is an auditing standard for assessing controls at service organizations, including data centers, in the U.S. It replaced SAS 70 in May 2017 and was later succeeded by SSAE 18. - **Key differences from SAS 70:** SSAE 16 requires auditors to get a written confirmation from management about how effective the controls are. - **International alignment:** SSAE 16 is also designed to align more closely with the international standard ISAE 3402, which deals with assurance reports on controls at service organizations.

Answer 2

Sure! Here’s a simpler breakdown of SOC 1 reports under SSAE 16: 1. **Purpose**: SOC 1 reports focus on controls that affect financial reporting. 2. **Who Can Use Them**: These reports are for existing customers and their auditors, not for potential customers or the public. 3. **Types of Reports**: - **Type 1**: This report gives an opinion on the description of the system and whether the controls are suitably designed at a specific date. - **Type 2**: This includes everything in Type 1 and also checks how well the controls worked over a period (usually 6 to 12 months). 4. **No Certification**: Just like SAS 70, there’s no official certification for SSAE 16 or SOC 1 reports. In short, SOC 1 reports assess and verify controls related to financial reporting for the use of current clients and their auditors. An audit that is conducted under SSAE 16 will result in a Service Organization Control (SOC) 1 report. These reports are focused on controls relevant to internal control over financial reporting. In essence, a SOC 1 report will be the form of reporting for a completed SSAE 16 audit. * As with SAS 70, SOC 1 reports are restricted use reports intended only for existing customers and their auditors, not prospective customers or the general public. * SOC 1 reports will be available as Type 1 or Type 2 reports – Type 1 reports present the auditors’ opinion regarding the accuracy and completeness of management’s description of the system or service as well as the suitability of the design of controls as of a specific date. – Type 2 SOC 1 reports include the Type 1 criteria AND audits the operating effectiveness of the controls throughout a declared time period, generally between six months and one year. Like SAS 70, there is no official SSAE 16 or SOC 1 “certificatio

Answer 3

SOC is looking at all isues regrding security aviality proccessing itegeity confideicny andprivary of a system and it s info based on predefined controls service organization control SOC 2 reprts are indend to prive assuranve about controls realted to securirty availabity, preccesing itegreity, confidentially and privary of a system and its information A SOC 2 rpeort is based on pre defined controls critera for evaluating the design and operating effectiveness of controls at a data center or other service organication(AICPA( trust services princples and critera)

Answer 4

-– SOC 3 reports provide the same level of assurance about controls as a SOC 2 repo -can be for general viewing -does not contain the detailed description of teting performed by the auditor -provides a summary opinion reagrding the effectives of the controls in plate at the data center or service organization once the auditor is aussred that the data center operator has achieved the turst sservices critera the comanpy can display the SOC 3 systrust for service organziation seal

Answer 5

HIPAA The Health Insurance Portability and Accountability Act of 1996 privacy and security of helath informtion organization can get a hippa audit PCI DSS the payment card indsutry data security standard was created by the major credit card issues, adn applies to companies that accept store prcoess and transmit credit cardholder dta

Answer 6

1. instiall and mainatain securrt controls 2. apply secure configurations to AI sytem compents 3. protect sotred account data 4. it msut by encrypted when its sent over w strong cryotgraphy 5. protect from malicous software 6. develop and mainatin secure systems and software 7. restrict access to system compenent and cardholder data by business need to know identifyusers 9. restic physcal acces to card dta 10. log and monitor all acces to sytem compneents and cardholder data 11. test securt stems regulary 12. support information sercurt with organization policeis and programs 1. build and matinain a secure network and sytems 2. protect acc data 3. maintian vunerbility magment proram 4. implemtn strong access control measures 4. regularly monitor and test networkds 5. maintain information securirt policy

Answer 7

PCI DSS rquiements apply to the crdholder dta CDE which coprised of ystem components, people, and processes that store, process, and transmit cardholder data and/or sensitive authentication data, and, – System components that may not store, process, or transmit CHD/SAD but have unrestricted connectivity to system components that store, process, or transmit CHD/SAD. AND System components, people, and processes that could impact the security of the CDE. * Each payment card brand has defined specific requirements for compliance validation and reporting, such as provisions for performing self- assessments and when to engage a Qualified Security Assessor (QSA). * Depending on an entity’s classification or risk level (determined by the individual payment card brands), processes for validating compliance and reporting to acquiring financial institutions usually follow this sequenc 1. confirm the scope of the PCI DSS assesment 2. Pefrom the PCI DSS assessment of the enviorment 3. complete the applicable reprot for the assessment accroding to the PCI DSS guidance and instrction 4. Complete the Attestation of Compliance for Service Providers or Merchants, as applicable, in its entirety. Official Attestations of Compliance are only available on the PCI SSC website. 5. Submit the applicable PCI SSC documentation and the Attestation of Compliance, along with any other requested documentation— such as ASV scan reports—to the requesting organization (those that manage compliance programs such as payment brands and acquirers (for merchants), or other requesters (for service providers)). 6. If required, perform remediation to address requirements that are not in place and provide an updated report.

Answer 8

NIST: THe natitonal institude of standards and technology overssees measurements in the US NIST is one of nations oldest physical science labortories

Answer 9

ISO/IEC 27001:2022 information security vybersecurity and prviary protection-ifnroamtion security managment systems requiements ISO/IEC 27002:2022 information security, cybersectutiy and privacy proetiention

Answer 10

ISO 9001-quality ISO IEC 27001-ifnroamtion securit ISO 20000-service magnament ISO 22301 -business conintiuity

Answer 11

-information securirty policies -access control -asset mangment -HR security -cryptography -physical and environemtnal security -communiation security -operation security -compliance

Answer 12

Wlecting an ovearching capability framwork and mapping other freameworks used in the orgnation to it

Answer 13

APQCs process classification framework is the most used process framework in the world it reates a common language for organizations to communicati and drine work processes comprehensivley without redunancies. organzitons are using it to support benchmarking, magnage content, and perform other important performance magnemnt actvities the categories are -develop and manage human capital -manage it -mange fiancial resources -aquire contrutct and mng assets -mage enterprise risk, compliance, remedtion, and reslity -manage external realtionships -develop and manage business capabilities

Answer 14

This document gives guidance on the governanceof organizaton, it provides princooples andkey aspects of practices to guide governing bodies and governing group on how to meet their responsiblites so that the organiations they govern can fulfil their purpose. it is also intended for stakeholders involved inor impaced by theorgnzation and its governance it is appliacle to all organizations regadless of type size lcoation sturuer or purpose

Answer 15

triangle 2 arros business pressures and business needs the triangle is corporote governance of it and under it is evalue evalue has to rros to direct and monitor direct arrow goes to plans and policies which goes to ict projects montior arrrow goes to ict operations and ict operations peformance confromance is mntired business process propals are evaluated by coprorate governance of IT

Week 5 part 1 Flashcards

(39 cards)