Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2

Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2

Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2.

These notes are organized systematically for students, IT auditors, CISA candidates, information security professionals and compliance interview preparation.

Here are your *COMPLETE EXAM-ORIENTED STUDY NOTES* for GMSISuccess – CISA / CPA / CIA Students – *ISO 27001 + Security Compliance + SOC 1 + SOC 2*

### 1. ISO 27001:2022 – INFORMATION SECURITY MANAGEMENT SYSTEM [ISMS]

*What is it?*

- International Standard for *Establishing, Implementing, Maintaining and Improving* an ISMS.

- Certifiable Standard – Issued by ISO. Certification valid for *3 years* with yearly surveillance audits.

- Latest version: *ISO 27001:2022* – 93 controls in Annex A.

*Structure – 10 Clauses [High Level Structure]:*

- Clause 4-10 are mandatory

- 4: Context of Organization

- 5: Leadership

- 6: Planning – Risk Assessment

- 7: Support

- 8: Operation

- 9: Performance Evaluation

- 10: Improvement

*Annex A – 93 Controls in 4 Themes:*

1. *Organizational – 37 controls* – Policies, Threat Intel, Incident Mgmt, Supplier relationships

2. *People – 8 controls* – Screening, Training, Disciplinary process

3. *Physical – 14 controls* – Physical entry, CCTV, Media disposal

4. *Technological – 34 controls* – Access control, Encryption, Secure coding, Logging, Data leakage prevention

*Key Documents to Audit:*

- *SoA – Statement of Applicability:* Heart of ISO 27001. Lists all 93 controls, which applicable, justification, implementation status. FIRST document auditor asks.

- *Risk Assessment & Risk Treatment Plan*

- *ISMS Scope Document*

*Certification Process:* Gap Assessment -> Risk Assessment -> SoA -> Implement Controls -> Internal Audit -> Stage 1 Audit -> Stage 2 Audit -> Certification[Documentation][Effectiveness]

*Who needs it?* Any company wanting to prove maturity of security to clients. Global standard.

---

### 2. SECURITY COMPLIANCE – BIG PICTURE

*Security Compliance = Adherence to laws, regulations, standards to protect information.*

Domain Regulation / Standard Applicability

**Privacy** GDPR, DPDP Act India, CCPA Personal Data

**Financial** SOX, PCI-DSS Financial Reporting, Card Data

**Cloud/SaaS** SOC 2, ISO 27017, CSA STAR Third Party Assurance

**Health** HIPAA US Health Data

**Outsourcing** RBI Outsourcing, DORA (EU), SEBI TPRM

*Auditor Approach:*

Compliance = Design + Operating Effectiveness + Continuous Monitoring.

---

### 3. SOC REPORTS – SSAE 18 STANDARD BY AICPA

*All SOC reports are governed by SSAE 18 by AICPA, issued by CPA firm.*

#### SOC 1 – INTERNAL CONTROL OVER FINANCIAL REPORTING [ICFR]

- *Purpose:* Controls relevant to CLIENT's FINANCIAL STATEMENTS. Can I trust this vendor for my financial reporting?

- *User:* User Entity's Financial Auditor + Management

- *Example Vendors:* Payroll Processor [ADP], Expense Processor, Loan Servicing, Claims Processor – Any vendor touching financials.

- *Framework:* Controls mapped to financial reporting objectives – Not fixed TSC.

- *Who reads:* CFO, External Auditor [EY]

- *Type:* Type 1 [Design at point in time] vs Type 2 [Operating Effectiveness over 6-12 months]

- *If qualified opinion in SOC 1?* – Financial Auditor cannot rely on vendor – Must do additional testing.[Deloitte]

#### SOC 2 – TRUST SERVICES CRITERIA – SECURITY, AVAILABILITY, CONFIDENTIALITY, PRIVACY, PROCESSING INTEGRITY

- *Purpose:* Controls relevant to SECURITY, AVAILABILITY, CONFIDENTIALITY of system. Can I trust this vendor with my DATA?

- *User:* Management, Clients, Regulators, Third Parties

- *Example Vendors:* AWS, Azure, SaaS, Data Center, Managed Security Provider – Any vendor hosting/processing data.

- *5 Trust Services Criteria [TSC] – By AICPA:*

   1. *Security [Common Criteria – Mandatory]:* Logical Access, Risk Assessment, System Monitoring – CC1 to CC8

   2. *Availability:* Uptime, DR, BCP – A1

   3. *Processing Integrity:* Completeness, Accuracy of processing – PI1

   4. *Confidentiality:* Encryption, Access to confidential info – C1

   5. *Privacy:* Personal info lifecycle as per privacy principles – P1 to P8

- *Type 1 vs Type 2 – Same logic:* Type 2 always preferred – Unqualified opinion within 12 months.

- *Opinion Types:* Unqualified, Qualified, Adverse [Major failure], Disclaimer [Cannot opine][Clean][Exceptions]

*CRITICAL CISA CONCEPTS IN SOC 2:*

- *CUEC – Complementary User Entity Controls:* Controls YOU must do. Vendor says – We are secure IF you also do quarterly access review. If you don't do CUEC, SOC 2 is useless for you. TPRM must track CUEC compliance.

- *Subservice Organizations / Carve-out vs Inclusive:* If vendor uses AWS and uses Carve-out method – AWS controls NOT covered in vendor's SOC 2 – You must get AWS SOC 2 separately. If Inclusive – Covered.

- *Management Assertion:* Management's claim that controls were effective.

- *System Description:* Vendor's own description of system boundaries.

#### SOC 3 – Public version of SOC 2 – General use – No confidential info – Can be put on website.

#### SOC 1 vs SOC 2 – DIRECT COMPARISON FOR EXAM:

Point SOC 1 SOC 2

**Focus** Financial Reporting – ICFR Data Security – Trust Services

**Question it answers** Can I trust vendor with my MONEY? Can I trust vendor with my DATA?

**Standard** SSAE 18 SSAE 18 + TSC

**Who needs it** Payroll, Financial processors Cloud, SaaS, IT vendors

**Framework** Client's financial controls AICPA TSC – 5 Criteria

**Restricted Use?** Yes – Restricted to user org & its auditor Yes – Restricted but wider audience

---

### 4. HOW TO REVIEW SOC REPORT – AUDIT PROCEDURE [CISA GOLD]

*5-Step Review:*

1. *Check Basics:* Report period [Is it within 12 months?], Auditor reputation [Big 4?], Type 2?

2. *Read Opinion:* Unqualified? If qualified, understand exception.

3. *Read Exceptions & Management Response:* Is exception related to my data? Has vendor remediated? Get evidence of remediation.

4. *Map CUECs:* Extract CUEC list and verify we implemented them. Document evidence.

5. *Check Subservice & Complementary Subservice Org Controls:* Need additional SOC reports?

*Red Flags:* Report older than 12 months, Type 1 only, Qualified opinion with no remediation, No coverage of Security criteria, Carve-out with no subservice SOC reports.

---

### 5. ISO 27001 vs SOC 2 – EXAM FAVORITE

ISO 27001 SOC 2

Certification for 3 years Attestation for 12-month period

93 controls – Annex A Trust Services Criteria – 5 TSC

Point-in-time + surveillance Tests Operating Effectiveness

Issued by ISO Certification Body Issued by CPA Firm [AICPA]

Global Acceptance US Market Mandate – SaaS must have

Proves ISMS maturity Proves security operationally worked

*Best Practice:* Mature companies get BOTH – ISO 27001 for ISMS, SOC 2 Type 2 for client assurance.

---

### 6. QUICK REVISION MNEMONICS:

- *SOC 1 = MONEY, SOC 2 = DATA*

- *TSC = SAPPC? Actually – Security is COMMON – S-A-P-C-P?* Remember: *"S ACPP" – Security, Availability, Confidentiality, Processing Integrity, Privacy*

- *CUEC = Vendor says – "My security works IF you also work"*

### Part 1: Foundations of Information Security

### 1.1 CIA Triad — Three Core Principles

The CIA Triad forms the foundation of information security.

\- Confidentiality

* Ensures that information is accessible only to authorized people.

* Protects against unauthorized disclosure, snooping and data theft.

* Common controls include encryption, passwords, multifactor authentication (MFA) and access permissions.

* Example: Only authorized customers can view their bank account details.

\- Integrity

* Ensures that information remains accurate, complete and protected against unauthorized changes.

* Protects against data manipulation, corruption and fraud.

* Common controls include digital signatures, hashes, validation checks, version control and audit logs.

* Example: A bank balance of ₹50,000 must not be changed without a valid transaction.

\- Availability

* Ensures that authorized users can access information and systems when required.

* Protects against outages, system crashes, ransomware and denial-of-service attacks.

* Common controls include backups, redundant servers, disaster recovery and business continuity plans.

* Example: Customers can access banking services when required, subject to scheduled maintenance.

\- Key exam point

* Confidentiality = Prevent unauthorized disclosure.

* Integrity = Prevent unauthorized or improper modification.

* Availability = Ensure timely access.

### 1.2 Information Security Management System (ISMS)

\- Definition

* An ISMS is an organization-wide framework of policies, processes, responsibilities, risk assessments and controls used to manage information security.

\- Key characteristics

* Integrates people, processes and technology.

* Identifies information security risks systematically.

* Establishes security policies and procedures.

* Assigns responsibilities and accountability.

* Monitors controls and investigates incidents.

* Supports continual improvement.

\- ISMS analogy

* An ISMS is like the operating system of an organization's security activities.

* It coordinates the different components required to protect information.

\- Without an effective ISMS

* Security activities may be reactive.

* Responsibilities may be unclear.

* Controls may be inconsistent.

* Documentation may be incomplete.

* Security incidents may go undetected.

\- With an effective ISMS

* Risks are identified proactively.

* Policies and procedures are documented.

* Management supports security initiatives.

* Controls are monitored and reviewed.

* Weaknesses are addressed systematically.

\- Example

* Without an ISMS, a company may discover a breach only after customer complaints.

* With an effective ISMS, monitoring tools may detect suspicious activity, and incident response procedures guide investigation and containment.

### 1.3 People, Process and Technology (PPT)

\- People

* Refers to employees, contractors, managers and other individuals involved in handling information.

* Security measures include:

    * Security awareness training.

    * Appropriate background screening.

    * Defined responsibilities.

    * Disciplinary procedures.

    * Secure employee onboarding and offboarding.

\- Process

* Refers to documented procedures and repeatable workflows.

* Examples include:

    * Incident response procedures.

    * Access approval workflows.

    * Backup schedules.

    * Change management procedures.

    * Business continuity plans.

\- Technology

* Refers to technical safeguards used to protect information.

* Examples include:

    * Firewalls.

    * Encryption.

    * Antivirus and endpoint protection.

    * Identity and access management.

    * Security monitoring systems.

\- Bank vault analogy

* People = Trained security guards.

* Process = Procedures for opening and closing the vault.

* Technology = Vault doors, alarms and surveillance cameras.

\- Key lesson

* A strong firewall cannot compensate fully for employees who disclose passwords.

* Well-trained employees cannot compensate fully for missing security procedures.

* Effective security requires all three pillars.

### Part 2: ISO/IEC 27001:2022 — Structure and Requirements

### 2.1 Meaning and Purpose of ISO 27001

* ISO/IEC 27001:2022 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving an ISMS.

* Its main purpose is to help organizations manage information security risks systematically.

* It covers organizational, human, physical and technological security considerations.

* It promotes a risk-based approach instead of relying solely on a fixed checklist.

* Certification demonstrates conformity with the standard's requirements within the defined certification scope.

* Certification does not guarantee that a security breach will never occur.

### 2.2 Structure of ISO 27001:2022

\- Clauses 0–3

* Introduce the standard, its scope, normative references and terminology.

* Provide the foundation for understanding the requirements.

\- Clauses 4–10

* Contain the core requirements for the ISMS.

* Form the main basis for conformity assessment and certification audits.

\- Annex A

* Contains a reference set of security controls.

* Helps organizations determine whether relevant controls have been overlooked during risk treatment.

* Is not a universal checklist requiring every control to be implemented by every organization.

### 2.3 The Seven Core Clauses: Clauses 4–10

\- Clause 4 — Context of the Organization

* Understand the organization's internal and external issues.

* Identify interested parties and their relevant requirements.

* Determine the scope of the ISMS.

* Establish the overall context in which information security risks must be managed.

\- Clause 5 — Leadership

* Obtain top management commitment.

* Establish the information security policy.

* Assign roles, responsibilities and authorities.

* Ensure information security is integrated into organizational activities.

\- Clause 6 — Planning

* Identify and assess information security risks.

* Determine risk treatment options.

* Establish information security objectives.

* Plan the actions required to address risks and achieve objectives.

\- Clause 7 — Support

* Provide resources for the ISMS.

* Ensure personnel have appropriate competence.

* Conduct awareness and training activities.

* Establish communication arrangements.

* Maintain controlled documented information.

\- Clause 8 — Operation

* Implement and control planned processes.

* Conduct information security risk assessments at planned intervals and when significant changes are proposed or occur, as applicable.

* Implement risk treatment plans.

* Maintain evidence of relevant operational activities.

\- Clause 9 — Performance Evaluation

* Monitor and measure ISMS performance.

* Evaluate the effectiveness of controls.

* Conduct internal audits.

* Perform management reviews.

* Identify weaknesses and areas requiring attention.

\- Clause 10 — Improvement

* Identify and manage nonconformities.

* Take corrective action.

* Investigate causes of problems.

* Prevent recurrence where possible.

* Continually improve the suitability, adequacy and effectiveness of the ISMS.

\- House-building analogy

* Clause 4 = Determine what kind of house is needed.

* Clause 5 = Obtain the owner's commitment.

* Clause 6 = Prepare the plan.

* Clause 7 = Arrange workers, resources and tools.

* Clause 8 = Build the house.

* Clause 9 = Inspect the house.

* Clause 10 = Correct defects and improve the structure.

### 2.4 Annex A Controls — 93 Controls

* ISO/IEC 27001:2022 Annex A contains 93 reference controls.

* These controls are organized into four themes:

\- Organizational controls — 37

* Security policies.

* Roles and responsibilities.

* Asset management.

* Supplier security.

* Information security incident management.

\- People controls — 8

* Screening.

* Security awareness and training.

* Responsibilities after termination or change of employment.

* Disciplinary processes.

\- Physical controls — 14

* Physical entry controls.

* Protection of equipment.

* Secure areas.

* Physical security monitoring.

\- Technological controls — 34

* Access control.

* Cryptography.

* Logging and monitoring.

* Malware protection.

* Secure configuration.

\- Must all 93 controls be implemented?

* No, not automatically.

* Organizations determine the necessary controls through risk assessment and treatment.

* Annex A is used as a reference to check that relevant controls have not been overlooked.

* Other appropriate controls may also be selected or developed.

* Exclusions from Annex A should be justified and documented in the Statement of Applicability.

* A control required by an identified risk, legal obligation or other applicable requirement cannot simply be ignored because it is inconvenient.

\- Example

* A small consulting firm may emphasize client confidentiality, remote access and device security.

* A hospital may require extensive controls for patient information, clinical systems and service availability.

### 2.5 Statement of Applicability (SoA)

* The SoA is a documented statement identifying the necessary controls for the organization's ISMS.

* It connects risk assessment and risk treatment to control selection.

* It identifies which controls are included and why.

* It records whether necessary controls have been implemented.

* It provides justification for excluding Annex A controls.

\- Example

* Asset inventory: Included because the organization uses laptops, servers and cloud resources.

* Access control: Included to restrict access to confidential information.

* Cryptography: Included to protect sensitive information.

* Physical security: Addressed through the organization's own facilities and relevant cloud provider arrangements, as applicable.

\- Key exam point

* The SoA is not merely a list of implemented controls; it also records the necessary controls and the justification for exclusions.

### 2.6 Key ISO 27001 Terminology

\- Risk assessment

* Identifies risks and analyzes and evaluates them against established criteria.

\- Risk treatment

* Determines how identified risks will be modified or otherwise addressed.

\- Risk owner

* The person accountable for managing a particular risk.

\- Nonconformity

* Failure to fulfill an applicable requirement of the standard or another requirement within the ISMS.

\- Corrective action

* Action taken to address the cause of a nonconformity and prevent recurrence.

\- Risk treatment options

* Modify or mitigate: Introduce controls to reduce likelihood or impact.

* Avoid: Stop the activity creating the risk.

* Share or transfer: Allocate some risk through insurance, contracts or other arrangements.

* Accept: Retain the risk following an authorized decision under the organization's risk criteria.

\- Important distinction

* Transferring risk does not necessarily transfer all accountability.

* Accepting risk does not eliminate it.

### Part 3: Core Features of ISO 27001

### 3.1 What Makes ISO 27001 Different?

\- Risk-based approach

* Select controls according to assessed risks and relevant requirements.

* Prioritize security investment.

\- Leadership-driven

* Top management supports and oversees the ISMS.

* Security becomes an organizational responsibility.

\- Continual improvement

* Monitor results, identify weaknesses and correct deficiencies.

* Adapt to changing risks.

\- Holistic approach

* Addresses people, processes and technology.

* Reduces weaknesses caused by gaps between departments or controls.

\- International recognition

* Certification can strengthen customer confidence.

* It may support vendor qualification and contractual requirements.

* It does not guarantee that all possible risks have been eliminated.

### 3.2 PDCA Cycle — Plan, Do, Check, Act

\- Plan

* Identify risks.

* Establish objectives.

* Design appropriate controls.

* Example: Approve a policy for protecting customer records through backups.

\- Do

* Implement the planned controls.

* Assign responsibilities.

* Example: Configure automated backups and restrict access.

\- Check

* Monitor controls and evaluate results.

* Conduct testing and audits.

* Example: Restore backup data and verify completeness.

\- Act

* Correct deficiencies and improve procedures.

* Example: Identify a database excluded from backups, correct the configuration and retest.

\- Key lesson

* A policy alone is insufficient.

* Controls must be implemented, tested and improved.

\- Exam clarification

* PDCA is a useful continual-improvement model.

* ISO 27001:2022 does not require PDCA to be used as a specific named methodology.

### Part 4: ISO 27001 Across Industries

### 4.1 Manufacturing Industry

\- IT and OT security

* Connected machinery can be targeted by cyberattacks.

* Controls include network segmentation, restricted remote access and industrial system security.

\- Intellectual property protection

* Blueprints, formulas and CAD designs may be commercially valuable.

* Controls include classification, encryption and restricted access.

\- Supply chain security

* Compromised suppliers may create entry points into factory systems.

* Controls include supplier assessments, secure agreements and controlled vendor access.

\- Production continuity

* Ransomware or system failure can stop production.

* Controls include tested backups, incident response and recovery plans.

\- Example

* A cyberattack on a car manufacturer's networked assembly line could interrupt production.

* Network segmentation and tested recovery procedures can reduce the impact.

### 4.2 Service Industry

\- Customer data privacy

* Banks, hospitals, hotels and logistics firms handle sensitive information.

* Controls include access restrictions, encryption and privacy procedures.

\- System availability

* Service outages may disrupt customer transactions or operations.

* Controls include redundancy, disaster recovery and business continuity planning.

\- Regulatory compliance

* Organizations must identify and comply with applicable legal and contractual requirements.

* Examples include GDPR and India's DPDP legislation, subject to their applicable requirements and commencement provisions.

\- Payment security

* Unauthorized transactions and payment fraud require appropriate preventive and detective controls.

\- Example

* If a logistics tracking system becomes unavailable, customers may be unable to track deliveries.

* Recovery arrangements can reduce downtime and customer disruption.

### 4.3 Consultancy Organizations

\- People-related risks

* Former employees may retain access to confidential client data.

* Apply prompt access revocation and formal offboarding procedures.

\- Process-related risks

* Teams working for competing clients may access each other's confidential files.

* Use client-specific permissions and documented information-sharing procedures.

\- Technology-related risks

* Consultants work from hotels, airports and client offices.

* Use MFA, secure connections, device management and endpoint protection.

\- Physical security risks

* Printed documents or unlocked screens may expose client information.

* Apply clear desk and clear screen practices.

\- Business benefit

* ISO 27001 certification can strengthen a consultancy's credibility.

* It may help satisfy customer and tender requirements.

### Part 5: SOC Reports and Attestation Standards

### 5.1 SOC Reports Overview

* SOC stands for System and Organization Controls.

* SOC reports provide information and assurance about controls at service organizations.

* They are particularly useful when businesses outsource services such as payroll, cloud hosting and payment processing.

\- SOC 1

* Focuses on controls relevant to user entities' internal control over financial reporting.

* Used by financial auditors, controllers and accounting teams.

\- SOC 2

* Addresses relevant Trust Services Criteria.

* Categories include security, availability, processing integrity, confidentiality and privacy.

* A particular report may cover only the categories relevant to its scope.

\- SOC 3

* Provides general-use reporting on relevant Trust Services Criteria.

* Is less detailed than the restricted-use SOC 2 report.

\- Restaurant analogy

* SOC 1: Examination of controls relevant to financial reporting.

* SOC 2: Detailed examination of relevant system security and service controls.

* SOC 3: Public-facing summary of relevant assurance information.

### 5.2 SSAE 18 vs. SSAE 21

* SSAE stands for Statements on Standards for Attestation Engagements.

* These are US professional standards issued by the AICPA.

* SSAE 18 established and revised attestation requirements relevant to SOC engagements.

* SSAE 21 updated the attestation framework and clarified approaches for certain examination engagements.

\- Assertion-based examination

* Management prepares an assertion about the subject matter or relevant criteria.

* The practitioner evaluates the assertion using evidence.

\- Direct examination

* The practitioner directly evaluates the subject matter against suitable criteria.

* The practitioner reports a conclusion based on the examination.

\- Important clarification

* SSAE 21 did not make management assertions universally optional for ordinary SOC 2 engagements.

* Requirements depend on the engagement type and applicable professional standards.

* SSAE 21 became effective for relevant practitioner examination or review reports dated on or after June 15, 2022, subject to its applicability provisions.

\- Exam tip

* Do not memorize SSAE 18 as “assertion always mandatory” and SSAE 21 as “assertion never required.”

* Identify the engagement type and applicable reporting requirements.

### 5.3 SOC Type 1 vs. Type 2

\- Type 1

* Evaluates the suitability of control design and whether controls are implemented as described at a specified date.

* Example: Assessing firewall control design and implementation as of January 1.

* Analogy: A photograph.

\- Type 2

* Evaluates the suitability of control design and operating effectiveness over a specified period.

* May involve testing samples of logs, approvals and transactions.

* Example: Testing firewall controls during a six-month examination period.

* Analogy: A video recording.

\- Key distinction

* Type 1 = Point-in-time assessment.

* Type 2 = Period-based assessment.

* A Type 2 report does not guarantee that controls worked perfectly at every moment.

* Review the auditor's opinion, scope, exceptions and test results.

### 5.4 Main Components of a SOC 2 Report

\- Independent service auditor's report

* Identifies scope, responsibilities, procedures and opinion.

\- Management's assertion

* Provides management's formal assertion where required.

\- Description of the system

* Describes services, infrastructure, personnel, processes, data and system boundaries.

\- Trust Services Criteria, controls and tests

* Describes relevant controls and examination procedures.

* A Type 2 report includes evidence of tests of operating effectiveness and their results.

\- Other information, where included

* May contain additional material supplied by management.

* Such information must be distinguished from the auditor's opinion.

\- Important

* SOC 2 reports are not universally divided into exactly five mandatory sections.

* An auditor's opinion is not simply labelled “Pass” or “Fail”; it may be unmodified, qualified, adverse or disclaimed, depending on the circumstances.

### 5.5 Processing Integrity

\- Processing integrity concerns whether system processing is complete, valid, accurate, timely and authorized in accordance with the system's objectives.

\- Completeness

* All relevant transactions are processed.

\- Validity

* Only valid transactions are processed.

\- Accuracy

* Amounts and calculations are correct.

\- Timeliness

* Transactions are processed within the expected period.

\- Authorization

* Processing follows appropriate authorization rules.

\- Example

* An e-commerce platform processes 10,000 orders.

* All orders should be recorded.

* Prices and taxes should be calculated correctly.

* Transactions should be processed on time.

* Unauthorized transactions should be prevented.

### 5.6 Bridge Letters or Gap Letters

* A bridge letter addresses the period between the end of a SOC report's coverage and a later date.

* It is typically prepared by the service organization rather than issued as a new independent auditor's opinion.

\- Typical contents

* Reference to the previous SOC report.

* Identification of the period covered by that report.

* Information about significant changes or incidents since the report period.

* The date through which management's update applies.

\- Example

* A SOC 2 report covers January to December 2025.

* A customer assesses the provider in April 2026.

* The bridge letter addresses the intervening period.

\- Limitation

* A bridge letter is not equivalent to a new SOC examination.

* Its usefulness depends on its scope, wording and supporting evidence.

### Part 6: Vendor Management and Shared Responsibility

### 6.1 Subservice Organizations

* A subservice organization is a third party used by a service organization to perform part of the service being examined.

* Examples include cloud infrastructure providers, data centers and payment processors.

\- Carve-out method

* Relevant subservice organization controls are excluded from the service auditor's examination.

* The report describes the subservice organization and the applicable scope boundary.

* Customers may need to review a separate SOC report.

\- Inclusive method

* Relevant subservice organization controls are included in the examination.

* Requires appropriate coordination, evidence and reporting arrangements.

\- Key lesson

* Neither method automatically establishes that a vendor is secure.

* Customers must understand the scope of the report and any additional controls required.

### 6.2 Complementary User Entity Controls (CUECs)

* CUECs are controls that a service organization expects its customers to implement.

* The provider's safeguards may not be sufficient unless the customer fulfills its own responsibilities.

\- Examples

* Cloud infrastructure provider supplies hosting; customer configures MFA and permissions.

* Cloud database provider supplies storage; customer establishes appropriate backup and recovery arrangements.

* SaaS provider supplies user accounts; customer removes access when employees leave.

* Payroll provider processes payroll; customer submits accurate, authorized payroll information and reviews results.

\- Why CUECs matter

* Missing customer controls may prevent overall control objectives from being achieved.

* A vendor's SOC report does not certify the customer's environment.

\- Exam point

* Provider controls and customer controls are complementary, not interchangeable.

### Part 7: Understanding Subject Matter in Audits

### 7.1 Underlying Subject Matter vs. Subject Matter Information

\- Underlying subject matter

* The actual system, activity, condition or matter being evaluated.

* Example: A service organization's information system and control activities.

\- Subject matter information

* Information describing, measuring or evaluating the underlying subject matter against suitable criteria.

* Example: A system description or report about the effectiveness of controls.

\- Fitness tracker analogy

* Underlying subject matter = Actual physical activity.

* Subject matter information = Tracker report showing steps and estimated calories.

\- Why the distinction matters

* A report can be inaccurate even when the underlying activity occurred correctly.

* Auditors need suitable criteria and sufficient appropriate evidence.

* Depending on the engagement, practitioners may examine management-prepared information or directly evaluate the underlying subject matter.

\- Exam clarification

* SSAE 21 helps clarify direct examination and related attestation concepts.

* It does not mean that all SOC 2 engagements have abandoned management assertions.

### Part 8: Risk Management Fundamentals

### 8.1 Risk Register

\- A risk register is a documented record for identifying, assessing, assigning and tracking risks.

\- Typical contents

* Risk identification number.

* Risk description.

* Affected asset or business function.

* Threat and vulnerability.

* Potential financial, legal, operational and reputational impact.

* Likelihood and impact ratings.

* Inherent and residual risk ratings, where used.

* Risk owner.

* Existing controls.

* Proposed treatment actions.

* Status and review date.

\- Example

* Risk: Ransomware attack on file servers.

* Likelihood: 4 out of 5.

* Impact: 5 out of 5.

* Initial score: 20 out of 25.

* Owner: IT Manager.

* Treatment: Endpoint detection, access restrictions, offline or immutable backups and recovery testing.

* Status: In progress.

### 8.2 Risk Calculation

\- A simple qualitative risk formula is:

\- Risk score = Likelihood × Impact.

\- Likelihood scale

* 1 = Rare.

* 2 = Unlikely.

* 3 = Possible.

* 4 = Likely.

* 5 = Almost certain.

\- Impact scale

* 1 = Negligible.

* 2 = Minor.

* 3 = Moderate.

* 4 = Major.

* 5 = Severe or catastrophic.

\- Example

* Likelihood = 4.

* Impact = 5.

* Risk score = 4 × 5 = 20 out of 25.

\- Illustrative risk classifications

* Scores 1–4: Low.

* Scores 5–12: Medium.

* Scores 13–25: High.

* These thresholds are examples, not mandatory ISO 27001 thresholds.

* Each organization should establish consistent assessment and risk acceptance criteria.

* ISO 27001 does not require every organization to use the multiplication formula.

### 8.3 Risk Heat Map

* A risk heat map compares likelihood and impact.

* Higher scores generally indicate greater priority for treatment.

| Impact / Likelihood | 1   | 2   | 3   | 4   | 5   |

| ------------------- | --- | --- | --- | --- | --- |

| 5 — Severe          | 5   | 10  | 15  | 20  | 25  |

| 4 — Major           | 4   | 8   | 12  | 16  | 20  |

| 3 — Moderate        | 3   | 6   | 9   | 12  | 15  |

| 2 — Minor           | 2   | 4   | 6   | 8   | 10  |

| 1 — Negligible      | 1   | 2   | 3   | 4   | 5   |

* Low risks may be monitored.

* Medium risks may require proportionate controls.

* High risks should be prioritized and escalated under the organization's procedures.

### 8.4 Inherent Risk vs. Residual Risk

\- Inherent risk

* Risk assessed before considering the relevant controls.

* Example: Ransomware risk rated 4 × 5 = 20.

\- Residual risk

* Risk remaining after considering implemented controls and their effectiveness.

* Example: After effective safeguards, likelihood falls to 2 and impact remains 5.

* Residual score = 2 × 5 = 10.

\- Key distinction

* Inherent risk = Before relevant controls.

* Residual risk = After considering controls.

* A lower residual score does not automatically mean the risk is acceptable.

* Compare residual risk with approved risk criteria and determine whether further treatment or authorized acceptance is required.

### Part 9: Asset Management

### 9.1 Asset Inventory

* An asset inventory records information assets and resources that store, process, transmit or protect information.

* Its purpose is to help the organization understand what must be protected.

\- Hardware assets

* Laptops.

* Servers.

* Routers.

* Mobile phones.

* Printers.

\- Software and cloud assets

* Applications.

* Databases.

* SaaS subscriptions.

* AWS and Azure accounts.

\- Information assets

* Customer databases.

* Source code.

* Financial records.

* Patents and confidential documents.

\- People and roles

* Employees.

* Contractors.

* Privileged users.

* Asset owners and custodians.

\- Facilities

* Offices.

* Data centers.

* Server rooms.

* Secure document storage areas.

\- Typical asset register fields

* Asset ID.

* Asset description.

* Owner.

* Location.

* Classification.

* Access requirements.

* Lifecycle status.

\- Example

* SRV-001: Production database server, owned by IT, located in Data Center A, classified as high sensitivity.

* DB-CUST: Customer personal data, owned by the relevant business data owner, stored in a cloud environment, classified according to its sensitivity.

\- Benefits

* Supports risk assessment.

* Establishes ownership.

* Helps select controls.

* Supports incident investigation.

* Assists with secure disposal and lifecycle management.

### Part 10: Change Management

### 10.1 Types of Changes

\- Standard change

* Routine, low-risk and repeatable.

* Pre-authorized under an approved procedure.

* Example: Routine patch deployment under an approved schedule.

\- Normal change

* Non-routine and subject to assessment.

* Requires the prescribed review, testing and authorization.

* Example: Major software upgrade or cloud migration.

\- Emergency change

* Required urgently to address a critical incident or risk.

* Uses expedited authorization.

* Requires documentation and appropriate retrospective review.

* Example: Urgent patch for a serious actively exploited vulnerability.

### 10.2 Normal Change Management Process

* Raise a change request.

* Assess business impact, risks and dependencies.

* Test the proposed change.

* Prepare a rollback plan.

* Obtain the required approval.

* Implement the change.

* Verify the outcome.

* Document the result.

### 10.3 Emergency Change Management Process

* Identify the urgent problem.

* Obtain expedited authorization.

* Implement the necessary change safely.

* Verify service restoration or risk reduction.

* Complete documentation.

* Conduct the required retrospective review.

\- Key exam points

* Standard change = Pre-authorized routine activity.

* Normal change = Assessed and approved change.

* Emergency change = Urgent change with expedited controls.

* Emergency does not mean uncontrolled.

* Standard does not mean undocumented.

* A Change Advisory Board (CAB) may advise on or approve changes, depending on the organization's arrangements.

### Part 11: Privacy and Legal Concepts

### 11.1 Cookies and Consent

\- Cookie

* A small piece of data stored in a browser by a website.

* May support login sessions, shopping carts, analytics and advertising.

\- Consent

* One possible legal basis for processing personal data.

* Must satisfy the requirements of the applicable law where consent is relied upon.

\- Essential cookies

* Support necessary functions such as login sessions or shopping carts.

* May qualify for an exemption from consent requirements where strictly necessary.

\- Analytics cookies

* Measure website usage and user behavior.

* Often require consent, depending on the applicable jurisdiction and implementation.

\- Marketing cookies

* Support advertising and tracking.

* Commonly require consent under applicable privacy and cookie rules.

\- GDPR consent principles

* Freely given.

* Specific.

* Informed.

* Unambiguous.

* Capable of being withdrawn.

\- Important

* A cookie banner is not automatically compliant merely because it displays an “Accept All” button.

* The design, available choices and actual tracking behavior matter.

* GDPR requirements should not be automatically applied as if they were identical to India's legal requirements.

* Indian organizations should assess the applicable DPDP legislation, rules and commencement provisions.

### 11.2 Master Service Agreement (MSA)

* Establishes the overall legal and commercial relationship between parties.

* May cover:

    * Intellectual property ownership.

    * Confidentiality.

    * Payment terms.

    * Indemnification.

    * Limitation of liability.

    * Dispute resolution.

    * Termination.

    * Data protection responsibilities.

\- Purpose

* Defines the general contractual framework.

* Helps allocate responsibilities and manage legal risks.

### 11.3 Service Level Agreement (SLA)

\- Defines measurable service performance commitments.

\- Common SLA metrics

* Availability or uptime.

* Incident response time.

* Resolution targets.

* Escalation procedures.

* Service credits or other contractual remedies.

\- Example

* Uptime target: 99.9% per month.

* Critical incident acknowledgment: Within one hour.

* Critical incident resolution target: Four hours, where contractually agreed.

\- Key distinction

* Response time = Time taken to acknowledge or begin responding.

* Resolution time = Time taken to resolve the issue.

### 11.4 Cloud Service Agreements

* Define terms and responsibilities for cloud services.

* Important concepts include:

    * Shared responsibility: Which security activities belong to the provider and customer.

    * Data portability: Ability to export data.

    * Data deletion: Handling of information at contract termination.

    * Data location: Where information is stored or processed.

    * Incident notification: How security incidents are reported.

    * Subcontractors: Which third parties may handle information.

\- Apartment analogy

* MSA = Overall lease.

* SLA = Specific service commitments.

* Cloud agreement = Detailed terms governing use and shared responsibilities.

\- Agreements may overlap; an SLA can form part of an MSA or cloud agreement.

### Part 12: Quick-Revision Bullet Points

* CIA Triad: Confidentiality, Integrity and Availability.

* ISMS: Organization-wide framework for managing information security.

* PPT: People, Process and Technology.

* ISO 27001:2022: Standard specifying ISMS requirements.

* Clauses 4–10: Seven core ISMS requirements clauses.

* Annex A: 93 reference controls organized into four themes.

* Risk assessment: Identify, analyze and evaluate risks.

* Risk treatment: Modify, avoid, share or accept risks.

* SoA: Identifies necessary controls, implementation status and justified exclusions.

* Nonconformity: Failure to fulfill an applicable requirement.

* PDCA: Plan, Do, Check, Act.

* Risk score: Likelihood × Impact in a simple model.

* Inherent risk: Risk before considering relevant controls.

* Residual risk: Risk remaining after considering controls.

* Asset inventory: Record of information assets and related resources.

* Change management: Controlled assessment, authorization and implementation of changes.

* SOC 1: Controls relevant to financial reporting.

* SOC 2: Relevant Trust Services Criteria for a service organization's system.

* SOC 3: General-use report on relevant Trust Services Criteria.

* SOC Type 1: Control design and implementation at a specified date.

* SOC Type 2: Control design and operating effectiveness over a specified period.

* SSAE 18 and SSAE 21: US attestation standards; requirements depend on the engagement.

* Processing integrity: Complete, valid, accurate, timely and authorized processing.

* Bridge letter: Management's update addressing the gap after a prior SOC report period.

* Subservice organization: Third party providing part of a service.

* Carve-out: Relevant subservice controls excluded from the service auditor's examination.

* Inclusive method: Relevant subservice controls included in the examination.

* CUECs: Controls the customer is expected to implement.

* Underlying subject matter: The actual matter being evaluated.

* Subject matter information: Information describing or measuring that matter against criteria.

* MSA: Overall contractual relationship.

* SLA: Measurable service performance commitments.

* Privacy consent: Must meet applicable legal requirements when used as the legal basis for processing.

### Part 13: Study Questions with Model Answers

1\. Explain the CIA Triad.

* Confidentiality prevents unauthorized disclosure.

* Integrity protects against unauthorized or improper changes.

* Availability ensures timely access to information and systems.

2\. What is an ISMS?

\- A structured system of policies, processes, responsibilities and controls for managing information security risks.

3\. Why are People, Process and Technology all important?

* People need appropriate awareness and accountability.

* Processes provide consistent procedures.

* Technology implements technical safeguards.

* Weakness in any pillar can undermine the others.

4\. Differentiate standard, normal and emergency changes.

* Standard: Routine and pre-authorized.

* Normal: Assessed, tested and approved.

* Emergency: Urgent, expedited and subject to appropriate documentation and review.

5\. What is a CUEC?

* A control the service provider expects its customer to implement.

* Example: Configuring MFA and access permissions for a cloud service.

6\. Differentiate SOC Type 1 and Type 2.

* Type 1 evaluates design and implementation at a specified date.

* Type 2 evaluates design and operating effectiveness over a specified period.

7\. Calculate risk for likelihood 4 and impact 5.

* Risk score = 4 × 5 = 20.

* The final classification depends on the organization's risk criteria.

8\. Differentiate inherent risk and residual risk.

* Inherent risk is assessed before considering relevant controls.

* Residual risk remains after considering controls and their effectiveness.

9\. What is a bridge letter?

* A document typically prepared by management to address changes or incidents since the end of the prior SOC report period.

* It does not replace a new independent SOC examination.

10\. Differentiate underlying subject matter and subject matter information.

* Underlying subject matter is the actual system, condition or activity being evaluated.

* Subject matter information is the report, description or measurement about that matter.

Additional practice questions

* Why are Clauses 4–10 central to ISO 27001 certification?

* Why are Annex A controls selected according to risk treatment rather than applied as a universal checklist?

* What is the difference between risk assessment and risk treatment?

* Why does ISO 27001 certification not guarantee that breaches will never occur?

* How does ISO 27001 certification differ from a SOC 2 report?

* Why should organizations test backup restoration?

* What is the difference between a carve-out and an inclusive approach?

* Why can a consent banner be noncompliant even if it has an “Accept All” button?

* How do an MSA and SLA complement each other?

* Why is a risk score of 20 not automatically classified as high under every risk methodology?

### Recommended Study Sequence

* Stage 1 — Fundamentals: CIA Triad, ISMS and People–Process–Technology.

* Stage 2 — ISO 27001: Clauses 4–10, Annex A, risk treatment and SoA.

* Stage 3 — Risk and operations: Risk register, asset inventory and change management.

* Stage 4 — Compliance: Privacy, consent, vendor agreements and shared responsibility.

* Stage 5 — SOC reporting: SOC 1/2/3, Type 1/Type 2, SSAE 18/21, CUECs and bridge letters.

* Stage 6 — Revision: Practice scenario-based questions, compare similar terms and explain the purpose of each control in your own words.

Here is *1-Page Summary* for CISA students – Quick Revision:

### SUMMARY: ISO 27001, Security Compliance, SOC 1, SOC 2

*1. ISO 27001:2022*

- International Standard for *ISMS*. Certifiable, valid 3 years.

- *93 controls* in Annex A – 4 themes: Organizational, People, Physical, Technological.

- Key document: *SoA – Statement of Applicability* – Lists which controls applicable.

- Proves company HAS security management system.

*2. Security Compliance*

- Following laws/standards to protect data – GDPR, PCI-DSS, HIPAA, DORA, RBI Outsourcing, DPDP.

- TPRM needs continuous monitoring, not yearly check.

*3. SOC 1*

- *Focus: MONEY – Financial Reporting [ICFR]*

- Question: Can I trust vendor for my financial statements?

- For: Payroll, Claims, Loan processors.

- Issued under SSAE 18 by CPA firm.

*4. SOC 2*

- *Focus: DATA – Security & Trust*

- Question: Can I trust vendor with my DATA?

- For: Cloud, SaaS, AWS, Data Centers.

- *5 Trust Criteria: Security + Availability + Processing Integrity + Confidentiality + Privacy*

- Always ask for *Type 2 – Unqualified, within 12 months.*[Mandatory]

*5. Key CISA Concepts in SOC 2*

- *CUEC:* Controls YOU must do, otherwise vendor's SOC 2 invalid for you.

- *Carve-out vs Inclusive:* Carve-out = Sub-vendor's controls NOT covered – You need separate SOC 2 of AWS etc.

*6. SOC 1 vs SOC 2 – Final Difference*

- *SOC 1 = Money / ICFR / CFO & External Auditor needs it*

- *SOC 2 = Data / Security / Client & CISO needs it*

*7. ISO 27001 vs SOC 2*

- ISO 27001 = Certification, 3 years, ISO body, 93 controls

- SOC 2 = Attestation, 12 months, CPA firm, 5 Trust Criteria

- Mature company = Has BOTH.

*Memory Trick: SOC 1 = MONEY, SOC 2 = DATA*

www.gmsisuccess.in