Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2
Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2.
These notes are organized systematically for students, IT auditors, CISA candidates, information security professionals and compliance interview preparation.
Here are your *COMPLETE EXAM-ORIENTED STUDY NOTES* for GMSISuccess – CISA / CPA / CIA Students – *ISO 27001 + Security Compliance + SOC 1 + SOC 2*
### 1. ISO 27001:2022 – INFORMATION SECURITY MANAGEMENT SYSTEM [ISMS]
*What is it?*
- International Standard for *Establishing, Implementing, Maintaining and Improving* an ISMS.
- Certifiable Standard – Issued by ISO. Certification valid for *3 years* with yearly surveillance audits.
- Latest version: *ISO 27001:2022* – 93 controls in Annex A.
*Structure – 10 Clauses [High Level Structure]:*
- Clause 4-10 are mandatory
- 4: Context of Organization
- 5: Leadership
- 6: Planning – Risk Assessment
- 7: Support
- 8: Operation
- 9: Performance Evaluation
- 10: Improvement
*Annex A – 93 Controls in 4 Themes:*
1. *Organizational – 37 controls* – Policies, Threat Intel, Incident Mgmt, Supplier relationships
2. *People – 8 controls* – Screening, Training, Disciplinary process
3. *Physical – 14 controls* – Physical entry, CCTV, Media disposal
4. *Technological – 34 controls* – Access control, Encryption, Secure coding, Logging, Data leakage prevention
*Key Documents to Audit:*
- *SoA – Statement of Applicability:* Heart of ISO 27001. Lists all 93 controls, which applicable, justification, implementation status. FIRST document auditor asks.
- *Risk Assessment & Risk Treatment Plan*
- *ISMS Scope Document*
*Certification Process:* Gap Assessment -> Risk Assessment -> SoA -> Implement Controls -> Internal Audit -> Stage 1 Audit -> Stage 2 Audit -> Certification[Documentation][Effectiveness]
*Who needs it?* Any company wanting to prove maturity of security to clients. Global standard.
---
### 2. SECURITY COMPLIANCE – BIG PICTURE
*Security Compliance = Adherence to laws, regulations, standards to protect information.*
Domain Regulation / Standard Applicability
**Privacy** GDPR, DPDP Act India, CCPA Personal Data
**Financial** SOX, PCI-DSS Financial Reporting, Card Data
**Cloud/SaaS** SOC 2, ISO 27017, CSA STAR Third Party Assurance
**Health** HIPAA US Health Data
**Outsourcing** RBI Outsourcing, DORA (EU), SEBI TPRM
*Auditor Approach:*
Compliance = Design + Operating Effectiveness + Continuous Monitoring.
---
### 3. SOC REPORTS – SSAE 18 STANDARD BY AICPA
*All SOC reports are governed by SSAE 18 by AICPA, issued by CPA firm.*
#### SOC 1 – INTERNAL CONTROL OVER FINANCIAL REPORTING [ICFR]
- *Purpose:* Controls relevant to CLIENT's FINANCIAL STATEMENTS. Can I trust this vendor for my financial reporting?
- *User:* User Entity's Financial Auditor + Management
- *Example Vendors:* Payroll Processor [ADP], Expense Processor, Loan Servicing, Claims Processor – Any vendor touching financials.
- *Framework:* Controls mapped to financial reporting objectives – Not fixed TSC.
- *Who reads:* CFO, External Auditor [EY]
- *Type:* Type 1 [Design at point in time] vs Type 2 [Operating Effectiveness over 6-12 months]
- *If qualified opinion in SOC 1?* – Financial Auditor cannot rely on vendor – Must do additional testing.[Deloitte]
#### SOC 2 – TRUST SERVICES CRITERIA – SECURITY, AVAILABILITY, CONFIDENTIALITY, PRIVACY, PROCESSING INTEGRITY
- *Purpose:* Controls relevant to SECURITY, AVAILABILITY, CONFIDENTIALITY of system. Can I trust this vendor with my DATA?
- *User:* Management, Clients, Regulators, Third Parties
- *Example Vendors:* AWS, Azure, SaaS, Data Center, Managed Security Provider – Any vendor hosting/processing data.
- *5 Trust Services Criteria [TSC] – By AICPA:*
1. *Security [Common Criteria – Mandatory]:* Logical Access, Risk Assessment, System Monitoring – CC1 to CC8
2. *Availability:* Uptime, DR, BCP – A1
3. *Processing Integrity:* Completeness, Accuracy of processing – PI1
4. *Confidentiality:* Encryption, Access to confidential info – C1
5. *Privacy:* Personal info lifecycle as per privacy principles – P1 to P8
- *Type 1 vs Type 2 – Same logic:* Type 2 always preferred – Unqualified opinion within 12 months.
- *Opinion Types:* Unqualified, Qualified, Adverse [Major failure], Disclaimer [Cannot opine][Clean][Exceptions]
*CRITICAL CISA CONCEPTS IN SOC 2:*
- *CUEC – Complementary User Entity Controls:* Controls YOU must do. Vendor says – We are secure IF you also do quarterly access review. If you don't do CUEC, SOC 2 is useless for you. TPRM must track CUEC compliance.
- *Subservice Organizations / Carve-out vs Inclusive:* If vendor uses AWS and uses Carve-out method – AWS controls NOT covered in vendor's SOC 2 – You must get AWS SOC 2 separately. If Inclusive – Covered.
- *Management Assertion:* Management's claim that controls were effective.
- *System Description:* Vendor's own description of system boundaries.
#### SOC 3 – Public version of SOC 2 – General use – No confidential info – Can be put on website.
#### SOC 1 vs SOC 2 – DIRECT COMPARISON FOR EXAM:
Point SOC 1 SOC 2
**Focus** Financial Reporting – ICFR Data Security – Trust Services
**Question it answers** Can I trust vendor with my MONEY? Can I trust vendor with my DATA?
**Standard** SSAE 18 SSAE 18 + TSC
**Who needs it** Payroll, Financial processors Cloud, SaaS, IT vendors
**Framework** Client's financial controls AICPA TSC – 5 Criteria
**Restricted Use?** Yes – Restricted to user org & its auditor Yes – Restricted but wider audience
---
### 4. HOW TO REVIEW SOC REPORT – AUDIT PROCEDURE [CISA GOLD]
*5-Step Review:*
1. *Check Basics:* Report period [Is it within 12 months?], Auditor reputation [Big 4?], Type 2?
2. *Read Opinion:* Unqualified? If qualified, understand exception.
3. *Read Exceptions & Management Response:* Is exception related to my data? Has vendor remediated? Get evidence of remediation.
4. *Map CUECs:* Extract CUEC list and verify we implemented them. Document evidence.
5. *Check Subservice & Complementary Subservice Org Controls:* Need additional SOC reports?
*Red Flags:* Report older than 12 months, Type 1 only, Qualified opinion with no remediation, No coverage of Security criteria, Carve-out with no subservice SOC reports.
---
### 5. ISO 27001 vs SOC 2 – EXAM FAVORITE
ISO 27001 SOC 2
Certification for 3 years Attestation for 12-month period
93 controls – Annex A Trust Services Criteria – 5 TSC
Point-in-time + surveillance Tests Operating Effectiveness
Issued by ISO Certification Body Issued by CPA Firm [AICPA]
Global Acceptance US Market Mandate – SaaS must have
Proves ISMS maturity Proves security operationally worked
*Best Practice:* Mature companies get BOTH – ISO 27001 for ISMS, SOC 2 Type 2 for client assurance.
---
### 6. QUICK REVISION MNEMONICS:
- *SOC 1 = MONEY, SOC 2 = DATA*
- *TSC = SAPPC? Actually – Security is COMMON – S-A-P-C-P?* Remember: *"S ACPP" – Security, Availability, Confidentiality, Processing Integrity, Privacy*
- *CUEC = Vendor says – "My security works IF you also work"*
### Part 1: Foundations of Information Security
### 1.1 CIA Triad — Three Core Principles
The CIA Triad forms the foundation of information security.
\- Confidentiality
* Ensures that information is accessible only to authorized people.
* Protects against unauthorized disclosure, snooping and data theft.
* Common controls include encryption, passwords, multifactor authentication (MFA) and access permissions.
* Example: Only authorized customers can view their bank account details.
\- Integrity
* Ensures that information remains accurate, complete and protected against unauthorized changes.
* Protects against data manipulation, corruption and fraud.
* Common controls include digital signatures, hashes, validation checks, version control and audit logs.
* Example: A bank balance of ₹50,000 must not be changed without a valid transaction.
\- Availability
* Ensures that authorized users can access information and systems when required.
* Protects against outages, system crashes, ransomware and denial-of-service attacks.
* Common controls include backups, redundant servers, disaster recovery and business continuity plans.
* Example: Customers can access banking services when required, subject to scheduled maintenance.
\- Key exam point
* Confidentiality = Prevent unauthorized disclosure.
* Integrity = Prevent unauthorized or improper modification.
* Availability = Ensure timely access.
### 1.2 Information Security Management System (ISMS)
\- Definition
* An ISMS is an organization-wide framework of policies, processes, responsibilities, risk assessments and controls used to manage information security.
\- Key characteristics
* Integrates people, processes and technology.
* Identifies information security risks systematically.
* Establishes security policies and procedures.
* Assigns responsibilities and accountability.
* Monitors controls and investigates incidents.
* Supports continual improvement.
\- ISMS analogy
* An ISMS is like the operating system of an organization's security activities.
* It coordinates the different components required to protect information.
\- Without an effective ISMS
* Security activities may be reactive.
* Responsibilities may be unclear.
* Controls may be inconsistent.
* Documentation may be incomplete.
* Security incidents may go undetected.
\- With an effective ISMS
* Risks are identified proactively.
* Policies and procedures are documented.
* Management supports security initiatives.
* Controls are monitored and reviewed.
* Weaknesses are addressed systematically.
\- Example
* Without an ISMS, a company may discover a breach only after customer complaints.
* With an effective ISMS, monitoring tools may detect suspicious activity, and incident response procedures guide investigation and containment.
### 1.3 People, Process and Technology (PPT)
\- People
* Refers to employees, contractors, managers and other individuals involved in handling information.
* Security measures include:
* Security awareness training.
* Appropriate background screening.
* Defined responsibilities.
* Disciplinary procedures.
* Secure employee onboarding and offboarding.
\- Process
* Refers to documented procedures and repeatable workflows.
* Examples include:
* Incident response procedures.
* Access approval workflows.
* Backup schedules.
* Change management procedures.
* Business continuity plans.
\- Technology
* Refers to technical safeguards used to protect information.
* Examples include:
* Firewalls.
* Encryption.
* Antivirus and endpoint protection.
* Identity and access management.
* Security monitoring systems.
\- Bank vault analogy
* People = Trained security guards.
* Process = Procedures for opening and closing the vault.
* Technology = Vault doors, alarms and surveillance cameras.
\- Key lesson
* A strong firewall cannot compensate fully for employees who disclose passwords.
* Well-trained employees cannot compensate fully for missing security procedures.
* Effective security requires all three pillars.
### Part 2: ISO/IEC 27001:2022 — Structure and Requirements
### 2.1 Meaning and Purpose of ISO 27001
* ISO/IEC 27001:2022 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving an ISMS.
* Its main purpose is to help organizations manage information security risks systematically.
* It covers organizational, human, physical and technological security considerations.
* It promotes a risk-based approach instead of relying solely on a fixed checklist.
* Certification demonstrates conformity with the standard's requirements within the defined certification scope.
* Certification does not guarantee that a security breach will never occur.
### 2.2 Structure of ISO 27001:2022
\- Clauses 0–3
* Introduce the standard, its scope, normative references and terminology.
* Provide the foundation for understanding the requirements.
\- Clauses 4–10
* Contain the core requirements for the ISMS.
* Form the main basis for conformity assessment and certification audits.
\- Annex A
* Contains a reference set of security controls.
* Helps organizations determine whether relevant controls have been overlooked during risk treatment.
* Is not a universal checklist requiring every control to be implemented by every organization.
### 2.3 The Seven Core Clauses: Clauses 4–10
\- Clause 4 — Context of the Organization
* Understand the organization's internal and external issues.
* Identify interested parties and their relevant requirements.
* Determine the scope of the ISMS.
* Establish the overall context in which information security risks must be managed.
\- Clause 5 — Leadership
* Obtain top management commitment.
* Establish the information security policy.
* Assign roles, responsibilities and authorities.
* Ensure information security is integrated into organizational activities.
\- Clause 6 — Planning
* Identify and assess information security risks.
* Determine risk treatment options.
* Establish information security objectives.
* Plan the actions required to address risks and achieve objectives.
\- Clause 7 — Support
* Provide resources for the ISMS.
* Ensure personnel have appropriate competence.
* Conduct awareness and training activities.
* Establish communication arrangements.
* Maintain controlled documented information.
\- Clause 8 — Operation
* Implement and control planned processes.
* Conduct information security risk assessments at planned intervals and when significant changes are proposed or occur, as applicable.
* Implement risk treatment plans.
* Maintain evidence of relevant operational activities.
\- Clause 9 — Performance Evaluation
* Monitor and measure ISMS performance.
* Evaluate the effectiveness of controls.
* Conduct internal audits.
* Perform management reviews.
* Identify weaknesses and areas requiring attention.
\- Clause 10 — Improvement
* Identify and manage nonconformities.
* Take corrective action.
* Investigate causes of problems.
* Prevent recurrence where possible.
* Continually improve the suitability, adequacy and effectiveness of the ISMS.
\- House-building analogy
* Clause 4 = Determine what kind of house is needed.
* Clause 5 = Obtain the owner's commitment.
* Clause 6 = Prepare the plan.
* Clause 7 = Arrange workers, resources and tools.
* Clause 8 = Build the house.
* Clause 9 = Inspect the house.
* Clause 10 = Correct defects and improve the structure.
### 2.4 Annex A Controls — 93 Controls
* ISO/IEC 27001:2022 Annex A contains 93 reference controls.
* These controls are organized into four themes:
\- Organizational controls — 37
* Security policies.
* Roles and responsibilities.
* Asset management.
* Supplier security.
* Information security incident management.
\- People controls — 8
* Screening.
* Security awareness and training.
* Responsibilities after termination or change of employment.
* Disciplinary processes.
\- Physical controls — 14
* Physical entry controls.
* Protection of equipment.
* Secure areas.
* Physical security monitoring.
\- Technological controls — 34
* Access control.
* Cryptography.
* Logging and monitoring.
* Malware protection.
* Secure configuration.
\- Must all 93 controls be implemented?
* No, not automatically.
* Organizations determine the necessary controls through risk assessment and treatment.
* Annex A is used as a reference to check that relevant controls have not been overlooked.
* Other appropriate controls may also be selected or developed.
* Exclusions from Annex A should be justified and documented in the Statement of Applicability.
* A control required by an identified risk, legal obligation or other applicable requirement cannot simply be ignored because it is inconvenient.
\- Example
* A small consulting firm may emphasize client confidentiality, remote access and device security.
* A hospital may require extensive controls for patient information, clinical systems and service availability.
### 2.5 Statement of Applicability (SoA)
* The SoA is a documented statement identifying the necessary controls for the organization's ISMS.
* It connects risk assessment and risk treatment to control selection.
* It identifies which controls are included and why.
* It records whether necessary controls have been implemented.
* It provides justification for excluding Annex A controls.
\- Example
* Asset inventory: Included because the organization uses laptops, servers and cloud resources.
* Access control: Included to restrict access to confidential information.
* Cryptography: Included to protect sensitive information.
* Physical security: Addressed through the organization's own facilities and relevant cloud provider arrangements, as applicable.
\- Key exam point
* The SoA is not merely a list of implemented controls; it also records the necessary controls and the justification for exclusions.
### 2.6 Key ISO 27001 Terminology
\- Risk assessment
* Identifies risks and analyzes and evaluates them against established criteria.
\- Risk treatment
* Determines how identified risks will be modified or otherwise addressed.
\- Risk owner
* The person accountable for managing a particular risk.
\- Nonconformity
* Failure to fulfill an applicable requirement of the standard or another requirement within the ISMS.
\- Corrective action
* Action taken to address the cause of a nonconformity and prevent recurrence.
\- Risk treatment options
* Modify or mitigate: Introduce controls to reduce likelihood or impact.
* Avoid: Stop the activity creating the risk.
* Share or transfer: Allocate some risk through insurance, contracts or other arrangements.
* Accept: Retain the risk following an authorized decision under the organization's risk criteria.
\- Important distinction
* Transferring risk does not necessarily transfer all accountability.
* Accepting risk does not eliminate it.
### Part 3: Core Features of ISO 27001
### 3.1 What Makes ISO 27001 Different?
\- Risk-based approach
* Select controls according to assessed risks and relevant requirements.
* Prioritize security investment.
\- Leadership-driven
* Top management supports and oversees the ISMS.
* Security becomes an organizational responsibility.
\- Continual improvement
* Monitor results, identify weaknesses and correct deficiencies.
* Adapt to changing risks.
\- Holistic approach
* Addresses people, processes and technology.
* Reduces weaknesses caused by gaps between departments or controls.
\- International recognition
* Certification can strengthen customer confidence.
* It may support vendor qualification and contractual requirements.
* It does not guarantee that all possible risks have been eliminated.
### 3.2 PDCA Cycle — Plan, Do, Check, Act
\- Plan
* Identify risks.
* Establish objectives.
* Design appropriate controls.
* Example: Approve a policy for protecting customer records through backups.
\- Do
* Implement the planned controls.
* Assign responsibilities.
* Example: Configure automated backups and restrict access.
\- Check
* Monitor controls and evaluate results.
* Conduct testing and audits.
* Example: Restore backup data and verify completeness.
\- Act
* Correct deficiencies and improve procedures.
* Example: Identify a database excluded from backups, correct the configuration and retest.
\- Key lesson
* A policy alone is insufficient.
* Controls must be implemented, tested and improved.
\- Exam clarification
* PDCA is a useful continual-improvement model.
* ISO 27001:2022 does not require PDCA to be used as a specific named methodology.
### Part 4: ISO 27001 Across Industries
### 4.1 Manufacturing Industry
\- IT and OT security
* Connected machinery can be targeted by cyberattacks.
* Controls include network segmentation, restricted remote access and industrial system security.
\- Intellectual property protection
* Blueprints, formulas and CAD designs may be commercially valuable.
* Controls include classification, encryption and restricted access.
\- Supply chain security
* Compromised suppliers may create entry points into factory systems.
* Controls include supplier assessments, secure agreements and controlled vendor access.
\- Production continuity
* Ransomware or system failure can stop production.
* Controls include tested backups, incident response and recovery plans.
\- Example
* A cyberattack on a car manufacturer's networked assembly line could interrupt production.
* Network segmentation and tested recovery procedures can reduce the impact.
### 4.2 Service Industry
\- Customer data privacy
* Banks, hospitals, hotels and logistics firms handle sensitive information.
* Controls include access restrictions, encryption and privacy procedures.
\- System availability
* Service outages may disrupt customer transactions or operations.
* Controls include redundancy, disaster recovery and business continuity planning.
\- Regulatory compliance
* Organizations must identify and comply with applicable legal and contractual requirements.
* Examples include GDPR and India's DPDP legislation, subject to their applicable requirements and commencement provisions.
\- Payment security
* Unauthorized transactions and payment fraud require appropriate preventive and detective controls.
\- Example
* If a logistics tracking system becomes unavailable, customers may be unable to track deliveries.
* Recovery arrangements can reduce downtime and customer disruption.
### 4.3 Consultancy Organizations
\- People-related risks
* Former employees may retain access to confidential client data.
* Apply prompt access revocation and formal offboarding procedures.
\- Process-related risks
* Teams working for competing clients may access each other's confidential files.
* Use client-specific permissions and documented information-sharing procedures.
\- Technology-related risks
* Consultants work from hotels, airports and client offices.
* Use MFA, secure connections, device management and endpoint protection.
\- Physical security risks
* Printed documents or unlocked screens may expose client information.
* Apply clear desk and clear screen practices.
\- Business benefit
* ISO 27001 certification can strengthen a consultancy's credibility.
* It may help satisfy customer and tender requirements.
### Part 5: SOC Reports and Attestation Standards
### 5.1 SOC Reports Overview
* SOC stands for System and Organization Controls.
* SOC reports provide information and assurance about controls at service organizations.
* They are particularly useful when businesses outsource services such as payroll, cloud hosting and payment processing.
\- SOC 1
* Focuses on controls relevant to user entities' internal control over financial reporting.
* Used by financial auditors, controllers and accounting teams.
\- SOC 2
* Addresses relevant Trust Services Criteria.
* Categories include security, availability, processing integrity, confidentiality and privacy.
* A particular report may cover only the categories relevant to its scope.
\- SOC 3
* Provides general-use reporting on relevant Trust Services Criteria.
* Is less detailed than the restricted-use SOC 2 report.
\- Restaurant analogy
* SOC 1: Examination of controls relevant to financial reporting.
* SOC 2: Detailed examination of relevant system security and service controls.
* SOC 3: Public-facing summary of relevant assurance information.
### 5.2 SSAE 18 vs. SSAE 21
* SSAE stands for Statements on Standards for Attestation Engagements.
* These are US professional standards issued by the AICPA.
* SSAE 18 established and revised attestation requirements relevant to SOC engagements.
* SSAE 21 updated the attestation framework and clarified approaches for certain examination engagements.
\- Assertion-based examination
* Management prepares an assertion about the subject matter or relevant criteria.
* The practitioner evaluates the assertion using evidence.
\- Direct examination
* The practitioner directly evaluates the subject matter against suitable criteria.
* The practitioner reports a conclusion based on the examination.
\- Important clarification
* SSAE 21 did not make management assertions universally optional for ordinary SOC 2 engagements.
* Requirements depend on the engagement type and applicable professional standards.
* SSAE 21 became effective for relevant practitioner examination or review reports dated on or after June 15, 2022, subject to its applicability provisions.
\- Exam tip
* Do not memorize SSAE 18 as “assertion always mandatory” and SSAE 21 as “assertion never required.”
* Identify the engagement type and applicable reporting requirements.
### 5.3 SOC Type 1 vs. Type 2
\- Type 1
* Evaluates the suitability of control design and whether controls are implemented as described at a specified date.
* Example: Assessing firewall control design and implementation as of January 1.
* Analogy: A photograph.
\- Type 2
* Evaluates the suitability of control design and operating effectiveness over a specified period.
* May involve testing samples of logs, approvals and transactions.
* Example: Testing firewall controls during a six-month examination period.
* Analogy: A video recording.
\- Key distinction
* Type 1 = Point-in-time assessment.
* Type 2 = Period-based assessment.
* A Type 2 report does not guarantee that controls worked perfectly at every moment.
* Review the auditor's opinion, scope, exceptions and test results.
### 5.4 Main Components of a SOC 2 Report
\- Independent service auditor's report
* Identifies scope, responsibilities, procedures and opinion.
\- Management's assertion
* Provides management's formal assertion where required.
\- Description of the system
* Describes services, infrastructure, personnel, processes, data and system boundaries.
\- Trust Services Criteria, controls and tests
* Describes relevant controls and examination procedures.
* A Type 2 report includes evidence of tests of operating effectiveness and their results.
\- Other information, where included
* May contain additional material supplied by management.
* Such information must be distinguished from the auditor's opinion.
\- Important
* SOC 2 reports are not universally divided into exactly five mandatory sections.
* An auditor's opinion is not simply labelled “Pass” or “Fail”; it may be unmodified, qualified, adverse or disclaimed, depending on the circumstances.
### 5.5 Processing Integrity
\- Processing integrity concerns whether system processing is complete, valid, accurate, timely and authorized in accordance with the system's objectives.
\- Completeness
* All relevant transactions are processed.
\- Validity
* Only valid transactions are processed.
\- Accuracy
* Amounts and calculations are correct.
\- Timeliness
* Transactions are processed within the expected period.
\- Authorization
* Processing follows appropriate authorization rules.
\- Example
* An e-commerce platform processes 10,000 orders.
* All orders should be recorded.
* Prices and taxes should be calculated correctly.
* Transactions should be processed on time.
* Unauthorized transactions should be prevented.
### 5.6 Bridge Letters or Gap Letters
* A bridge letter addresses the period between the end of a SOC report's coverage and a later date.
* It is typically prepared by the service organization rather than issued as a new independent auditor's opinion.
\- Typical contents
* Reference to the previous SOC report.
* Identification of the period covered by that report.
* Information about significant changes or incidents since the report period.
* The date through which management's update applies.
\- Example
* A SOC 2 report covers January to December 2025.
* A customer assesses the provider in April 2026.
* The bridge letter addresses the intervening period.
\- Limitation
* A bridge letter is not equivalent to a new SOC examination.
* Its usefulness depends on its scope, wording and supporting evidence.
### Part 6: Vendor Management and Shared Responsibility
### 6.1 Subservice Organizations
* A subservice organization is a third party used by a service organization to perform part of the service being examined.
* Examples include cloud infrastructure providers, data centers and payment processors.
\- Carve-out method
* Relevant subservice organization controls are excluded from the service auditor's examination.
* The report describes the subservice organization and the applicable scope boundary.
* Customers may need to review a separate SOC report.
\- Inclusive method
* Relevant subservice organization controls are included in the examination.
* Requires appropriate coordination, evidence and reporting arrangements.
\- Key lesson
* Neither method automatically establishes that a vendor is secure.
* Customers must understand the scope of the report and any additional controls required.
### 6.2 Complementary User Entity Controls (CUECs)
* CUECs are controls that a service organization expects its customers to implement.
* The provider's safeguards may not be sufficient unless the customer fulfills its own responsibilities.
\- Examples
* Cloud infrastructure provider supplies hosting; customer configures MFA and permissions.
* Cloud database provider supplies storage; customer establishes appropriate backup and recovery arrangements.
* SaaS provider supplies user accounts; customer removes access when employees leave.
* Payroll provider processes payroll; customer submits accurate, authorized payroll information and reviews results.
\- Why CUECs matter
* Missing customer controls may prevent overall control objectives from being achieved.
* A vendor's SOC report does not certify the customer's environment.
\- Exam point
* Provider controls and customer controls are complementary, not interchangeable.
### Part 7: Understanding Subject Matter in Audits
### 7.1 Underlying Subject Matter vs. Subject Matter Information
\- Underlying subject matter
* The actual system, activity, condition or matter being evaluated.
* Example: A service organization's information system and control activities.
\- Subject matter information
* Information describing, measuring or evaluating the underlying subject matter against suitable criteria.
* Example: A system description or report about the effectiveness of controls.
\- Fitness tracker analogy
* Underlying subject matter = Actual physical activity.
* Subject matter information = Tracker report showing steps and estimated calories.
\- Why the distinction matters
* A report can be inaccurate even when the underlying activity occurred correctly.
* Auditors need suitable criteria and sufficient appropriate evidence.
* Depending on the engagement, practitioners may examine management-prepared information or directly evaluate the underlying subject matter.
\- Exam clarification
* SSAE 21 helps clarify direct examination and related attestation concepts.
* It does not mean that all SOC 2 engagements have abandoned management assertions.
### Part 8: Risk Management Fundamentals
### 8.1 Risk Register
\- A risk register is a documented record for identifying, assessing, assigning and tracking risks.
\- Typical contents
* Risk identification number.
* Risk description.
* Affected asset or business function.
* Threat and vulnerability.
* Potential financial, legal, operational and reputational impact.
* Likelihood and impact ratings.
* Inherent and residual risk ratings, where used.
* Risk owner.
* Existing controls.
* Proposed treatment actions.
* Status and review date.
\- Example
* Risk: Ransomware attack on file servers.
* Likelihood: 4 out of 5.
* Impact: 5 out of 5.
* Initial score: 20 out of 25.
* Owner: IT Manager.
* Treatment: Endpoint detection, access restrictions, offline or immutable backups and recovery testing.
* Status: In progress.
### 8.2 Risk Calculation
\- A simple qualitative risk formula is:
\- Risk score = Likelihood × Impact.
\- Likelihood scale
* 1 = Rare.
* 2 = Unlikely.
* 3 = Possible.
* 4 = Likely.
* 5 = Almost certain.
\- Impact scale
* 1 = Negligible.
* 2 = Minor.
* 3 = Moderate.
* 4 = Major.
* 5 = Severe or catastrophic.
\- Example
* Likelihood = 4.
* Impact = 5.
* Risk score = 4 × 5 = 20 out of 25.
\- Illustrative risk classifications
* Scores 1–4: Low.
* Scores 5–12: Medium.
* Scores 13–25: High.
* These thresholds are examples, not mandatory ISO 27001 thresholds.
* Each organization should establish consistent assessment and risk acceptance criteria.
* ISO 27001 does not require every organization to use the multiplication formula.
### 8.3 Risk Heat Map
* A risk heat map compares likelihood and impact.
* Higher scores generally indicate greater priority for treatment.
| Impact / Likelihood | 1 | 2 | 3 | 4 | 5 |
| ------------------- | --- | --- | --- | --- | --- |
| 5 — Severe | 5 | 10 | 15 | 20 | 25 |
| 4 — Major | 4 | 8 | 12 | 16 | 20 |
| 3 — Moderate | 3 | 6 | 9 | 12 | 15 |
| 2 — Minor | 2 | 4 | 6 | 8 | 10 |
| 1 — Negligible | 1 | 2 | 3 | 4 | 5 |
* Low risks may be monitored.
* Medium risks may require proportionate controls.
* High risks should be prioritized and escalated under the organization's procedures.
### 8.4 Inherent Risk vs. Residual Risk
\- Inherent risk
* Risk assessed before considering the relevant controls.
* Example: Ransomware risk rated 4 × 5 = 20.
\- Residual risk
* Risk remaining after considering implemented controls and their effectiveness.
* Example: After effective safeguards, likelihood falls to 2 and impact remains 5.
* Residual score = 2 × 5 = 10.
\- Key distinction
* Inherent risk = Before relevant controls.
* Residual risk = After considering controls.
* A lower residual score does not automatically mean the risk is acceptable.
* Compare residual risk with approved risk criteria and determine whether further treatment or authorized acceptance is required.
### Part 9: Asset Management
### 9.1 Asset Inventory
* An asset inventory records information assets and resources that store, process, transmit or protect information.
* Its purpose is to help the organization understand what must be protected.
\- Hardware assets
* Laptops.
* Servers.
* Routers.
* Mobile phones.
* Printers.
\- Software and cloud assets
* Applications.
* Databases.
* SaaS subscriptions.
* AWS and Azure accounts.
\- Information assets
* Customer databases.
* Source code.
* Financial records.
* Patents and confidential documents.
\- People and roles
* Employees.
* Contractors.
* Privileged users.
* Asset owners and custodians.
\- Facilities
* Offices.
* Data centers.
* Server rooms.
* Secure document storage areas.
\- Typical asset register fields
* Asset ID.
* Asset description.
* Owner.
* Location.
* Classification.
* Access requirements.
* Lifecycle status.
\- Example
* SRV-001: Production database server, owned by IT, located in Data Center A, classified as high sensitivity.
* DB-CUST: Customer personal data, owned by the relevant business data owner, stored in a cloud environment, classified according to its sensitivity.
\- Benefits
* Supports risk assessment.
* Establishes ownership.
* Helps select controls.
* Supports incident investigation.
* Assists with secure disposal and lifecycle management.
### Part 10: Change Management
### 10.1 Types of Changes
\- Standard change
* Routine, low-risk and repeatable.
* Pre-authorized under an approved procedure.
* Example: Routine patch deployment under an approved schedule.
\- Normal change
* Non-routine and subject to assessment.
* Requires the prescribed review, testing and authorization.
* Example: Major software upgrade or cloud migration.
\- Emergency change
* Required urgently to address a critical incident or risk.
* Uses expedited authorization.
* Requires documentation and appropriate retrospective review.
* Example: Urgent patch for a serious actively exploited vulnerability.
### 10.2 Normal Change Management Process
* Raise a change request.
* Assess business impact, risks and dependencies.
* Test the proposed change.
* Prepare a rollback plan.
* Obtain the required approval.
* Implement the change.
* Verify the outcome.
* Document the result.
### 10.3 Emergency Change Management Process
* Identify the urgent problem.
* Obtain expedited authorization.
* Implement the necessary change safely.
* Verify service restoration or risk reduction.
* Complete documentation.
* Conduct the required retrospective review.
\- Key exam points
* Standard change = Pre-authorized routine activity.
* Normal change = Assessed and approved change.
* Emergency change = Urgent change with expedited controls.
* Emergency does not mean uncontrolled.
* Standard does not mean undocumented.
* A Change Advisory Board (CAB) may advise on or approve changes, depending on the organization's arrangements.
### Part 11: Privacy and Legal Concepts
### 11.1 Cookies and Consent
\- Cookie
* A small piece of data stored in a browser by a website.
* May support login sessions, shopping carts, analytics and advertising.
\- Consent
* One possible legal basis for processing personal data.
* Must satisfy the requirements of the applicable law where consent is relied upon.
\- Essential cookies
* Support necessary functions such as login sessions or shopping carts.
* May qualify for an exemption from consent requirements where strictly necessary.
\- Analytics cookies
* Measure website usage and user behavior.
* Often require consent, depending on the applicable jurisdiction and implementation.
\- Marketing cookies
* Support advertising and tracking.
* Commonly require consent under applicable privacy and cookie rules.
\- GDPR consent principles
* Freely given.
* Specific.
* Informed.
* Unambiguous.
* Capable of being withdrawn.
\- Important
* A cookie banner is not automatically compliant merely because it displays an “Accept All” button.
* The design, available choices and actual tracking behavior matter.
* GDPR requirements should not be automatically applied as if they were identical to India's legal requirements.
* Indian organizations should assess the applicable DPDP legislation, rules and commencement provisions.
### 11.2 Master Service Agreement (MSA)
* Establishes the overall legal and commercial relationship between parties.
* May cover:
* Intellectual property ownership.
* Confidentiality.
* Payment terms.
* Indemnification.
* Limitation of liability.
* Dispute resolution.
* Termination.
* Data protection responsibilities.
\- Purpose
* Defines the general contractual framework.
* Helps allocate responsibilities and manage legal risks.
### 11.3 Service Level Agreement (SLA)
\- Defines measurable service performance commitments.
\- Common SLA metrics
* Availability or uptime.
* Incident response time.
* Resolution targets.
* Escalation procedures.
* Service credits or other contractual remedies.
\- Example
* Uptime target: 99.9% per month.
* Critical incident acknowledgment: Within one hour.
* Critical incident resolution target: Four hours, where contractually agreed.
\- Key distinction
* Response time = Time taken to acknowledge or begin responding.
* Resolution time = Time taken to resolve the issue.
### 11.4 Cloud Service Agreements
* Define terms and responsibilities for cloud services.
* Important concepts include:
* Shared responsibility: Which security activities belong to the provider and customer.
* Data portability: Ability to export data.
* Data deletion: Handling of information at contract termination.
* Data location: Where information is stored or processed.
* Incident notification: How security incidents are reported.
* Subcontractors: Which third parties may handle information.
\- Apartment analogy
* MSA = Overall lease.
* SLA = Specific service commitments.
* Cloud agreement = Detailed terms governing use and shared responsibilities.
\- Agreements may overlap; an SLA can form part of an MSA or cloud agreement.
### Part 12: Quick-Revision Bullet Points
* CIA Triad: Confidentiality, Integrity and Availability.
* ISMS: Organization-wide framework for managing information security.
* PPT: People, Process and Technology.
* ISO 27001:2022: Standard specifying ISMS requirements.
* Clauses 4–10: Seven core ISMS requirements clauses.
* Annex A: 93 reference controls organized into four themes.
* Risk assessment: Identify, analyze and evaluate risks.
* Risk treatment: Modify, avoid, share or accept risks.
* SoA: Identifies necessary controls, implementation status and justified exclusions.
* Nonconformity: Failure to fulfill an applicable requirement.
* PDCA: Plan, Do, Check, Act.
* Risk score: Likelihood × Impact in a simple model.
* Inherent risk: Risk before considering relevant controls.
* Residual risk: Risk remaining after considering controls.
* Asset inventory: Record of information assets and related resources.
* Change management: Controlled assessment, authorization and implementation of changes.
* SOC 1: Controls relevant to financial reporting.
* SOC 2: Relevant Trust Services Criteria for a service organization's system.
* SOC 3: General-use report on relevant Trust Services Criteria.
* SOC Type 1: Control design and implementation at a specified date.
* SOC Type 2: Control design and operating effectiveness over a specified period.
* SSAE 18 and SSAE 21: US attestation standards; requirements depend on the engagement.
* Processing integrity: Complete, valid, accurate, timely and authorized processing.
* Bridge letter: Management's update addressing the gap after a prior SOC report period.
* Subservice organization: Third party providing part of a service.
* Carve-out: Relevant subservice controls excluded from the service auditor's examination.
* Inclusive method: Relevant subservice controls included in the examination.
* CUECs: Controls the customer is expected to implement.
* Underlying subject matter: The actual matter being evaluated.
* Subject matter information: Information describing or measuring that matter against criteria.
* MSA: Overall contractual relationship.
* SLA: Measurable service performance commitments.
* Privacy consent: Must meet applicable legal requirements when used as the legal basis for processing.
### Part 13: Study Questions with Model Answers
1\. Explain the CIA Triad.
* Confidentiality prevents unauthorized disclosure.
* Integrity protects against unauthorized or improper changes.
* Availability ensures timely access to information and systems.
2\. What is an ISMS?
\- A structured system of policies, processes, responsibilities and controls for managing information security risks.
3\. Why are People, Process and Technology all important?
* People need appropriate awareness and accountability.
* Processes provide consistent procedures.
* Technology implements technical safeguards.
* Weakness in any pillar can undermine the others.
4\. Differentiate standard, normal and emergency changes.
* Standard: Routine and pre-authorized.
* Normal: Assessed, tested and approved.
* Emergency: Urgent, expedited and subject to appropriate documentation and review.
5\. What is a CUEC?
* A control the service provider expects its customer to implement.
* Example: Configuring MFA and access permissions for a cloud service.
6\. Differentiate SOC Type 1 and Type 2.
* Type 1 evaluates design and implementation at a specified date.
* Type 2 evaluates design and operating effectiveness over a specified period.
7\. Calculate risk for likelihood 4 and impact 5.
* Risk score = 4 × 5 = 20.
* The final classification depends on the organization's risk criteria.
8\. Differentiate inherent risk and residual risk.
* Inherent risk is assessed before considering relevant controls.
* Residual risk remains after considering controls and their effectiveness.
9\. What is a bridge letter?
* A document typically prepared by management to address changes or incidents since the end of the prior SOC report period.
* It does not replace a new independent SOC examination.
10\. Differentiate underlying subject matter and subject matter information.
* Underlying subject matter is the actual system, condition or activity being evaluated.
* Subject matter information is the report, description or measurement about that matter.
Additional practice questions
* Why are Clauses 4–10 central to ISO 27001 certification?
* Why are Annex A controls selected according to risk treatment rather than applied as a universal checklist?
* What is the difference between risk assessment and risk treatment?
* Why does ISO 27001 certification not guarantee that breaches will never occur?
* How does ISO 27001 certification differ from a SOC 2 report?
* Why should organizations test backup restoration?
* What is the difference between a carve-out and an inclusive approach?
* Why can a consent banner be noncompliant even if it has an “Accept All” button?
* How do an MSA and SLA complement each other?
* Why is a risk score of 20 not automatically classified as high under every risk methodology?
### Recommended Study Sequence
* Stage 1 — Fundamentals: CIA Triad, ISMS and People–Process–Technology.
* Stage 2 — ISO 27001: Clauses 4–10, Annex A, risk treatment and SoA.
* Stage 3 — Risk and operations: Risk register, asset inventory and change management.
* Stage 4 — Compliance: Privacy, consent, vendor agreements and shared responsibility.
* Stage 5 — SOC reporting: SOC 1/2/3, Type 1/Type 2, SSAE 18/21, CUECs and bridge letters.
* Stage 6 — Revision: Practice scenario-based questions, compare similar terms and explain the purpose of each control in your own words.
Here is *1-Page Summary* for CISA students – Quick Revision:
### SUMMARY: ISO 27001, Security Compliance, SOC 1, SOC 2
*1. ISO 27001:2022*
- International Standard for *ISMS*. Certifiable, valid 3 years.
- *93 controls* in Annex A – 4 themes: Organizational, People, Physical, Technological.
- Key document: *SoA – Statement of Applicability* – Lists which controls applicable.
- Proves company HAS security management system.
*2. Security Compliance*
- Following laws/standards to protect data – GDPR, PCI-DSS, HIPAA, DORA, RBI Outsourcing, DPDP.
- TPRM needs continuous monitoring, not yearly check.
*3. SOC 1*
- *Focus: MONEY – Financial Reporting [ICFR]*
- Question: Can I trust vendor for my financial statements?
- For: Payroll, Claims, Loan processors.
- Issued under SSAE 18 by CPA firm.
*4. SOC 2*
- *Focus: DATA – Security & Trust*
- Question: Can I trust vendor with my DATA?
- For: Cloud, SaaS, AWS, Data Centers.
- *5 Trust Criteria: Security + Availability + Processing Integrity + Confidentiality + Privacy*
- Always ask for *Type 2 – Unqualified, within 12 months.*[Mandatory]
*5. Key CISA Concepts in SOC 2*
- *CUEC:* Controls YOU must do, otherwise vendor's SOC 2 invalid for you.
- *Carve-out vs Inclusive:* Carve-out = Sub-vendor's controls NOT covered – You need separate SOC 2 of AWS etc.
*6. SOC 1 vs SOC 2 – Final Difference*
- *SOC 1 = Money / ICFR / CFO & External Auditor needs it*
- *SOC 2 = Data / Security / Client & CISO needs it*
*7. ISO 27001 vs SOC 2*
- ISO 27001 = Certification, 3 years, ISO body, 93 controls
- SOC 2 = Attestation, 12 months, CPA firm, 5 Trust Criteria
- Mature company = Has BOTH.
*Memory Trick: SOC 1 = MONEY, SOC 2 = DATA*
www.gmsisuccess.in
