No Result
View All Result
SUBSCRIBE | NO FEES, NO PAYWALLS
MANAGE MY SUBSCRIPTION
NEWSLETTER
Corporate Compliance Insights
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Compliance

Remote Compliance: Managing InfoSec Audits from a Distance

How to Stay on Top of Your Protections in a Pandemic

by Patrick Murray
December 11, 2020
in Compliance, Featured
woman working at laptop at home with cup of black coffee

COVID has complicated everything, and information security audits are no exception. Tugboat Logic’s CPO, Patrick Murray, explores the various challenges organizations face in conducting infosec audits remotely and outlines best practices to make the transition.

With the number of different issues companies are dealing with now, from financial fallout to having to put into place new infrastructure and policies, compliance can easily fall by the wayside. Security audits can be a challenge in the best and easiest of times – and the mass move to remote work during the pandemic has only further complicated things. That means something like SOC 2 compliance can take a back seat – but the consequences of letting it slide are significant.

A big part of the problem is that for many organizations, audits can seem like a complete mystery. A lot of concern and frustration that can result from a variety of areas, such as not knowing the scope of an audit, how much time it will take and how much it will cost. Below are strategies business leaders can apply to best work with auditors, handle evidence collection and implement compliance controls given the new complexities of the business landscape.

Challenges of Audits and Compliance in a Remote Work World

Making the switch to a fully remote workforce has been challenging for companies, to say the least, and so has moving to remote audits. Time is being spent not only on moving to remote audits, but also on maintaining the required rigor for controls. As a result, audits are sometimes getting delayed. The coronavirus-spurred recession has also led some companies to downsize, which means it can also take longer to gather evidence for audits because there are fewer people. A best practice is to designate a project manager to keep track of everything and everyone so that your audit doesn’t get delayed.

Startups often run on a shoestring, so the odds of having someone on staff who knows how to do this work are low. In addition, there’s an ongoing shortage of cybersecurity talent, but there’s no shortage of tasks involved in audits; you must implement and gather evidence for an average of 75 to 100 security controls, many of which need to be collected multiple times over an audit observation period of one year.

And consultants are very little help when it comes to finding out what an information security audit entails, how much it costs to prepare or how long the preparation takes – after all, consultants do get paid by the hour. It’s like taking a test, but you don’t know what’s on the test. Faced with this ambiguity and difficulty, many organizations procrastinate. However, the bottom line is that a security audit is not rocket science. Security is finite, and what needs to be protected is the same across the board. Focus on what is susceptible and where.

Maintaining security has already been a challenge even before organizations moved to remote work. With more people working from home, a new risk assessment needs to be done to ensure people are secure while working from home. New measures need to be implemented, such as a mobile device management solution to protect work data on personal devices. Or, if you’ve moved to SaaS apps for remote collaboration, such as Zoom or Slack, you need to ensure they’ve been configured securely. And you need to have a solid plan in place for on-boarding and off-boarding employees to make sure you don’t have non-permitted access to enterprise apps and other tools.

Best Practices

With neither auditors nor customers on-site at the office, the evidence collection process requires a slightly different approach. Remote or not, keeping all the evidence in one place and making sure that collection activities are being done from the get-go will save hassle. Time, heartache and surprises can also be avoided by creating a process with your auditor at the very beginning of your engagement.

That brings us to another important factor: Your relationship with your auditor. Auditors are not your enemy. They aren’t out to get you. They want you to pass, and they want to help you pass. The more secure their clients are, the better it is for everyone. Communication is essential. Even if it feels like over-communicating, it’s better to have your auditor know that you’re consistently making a good-faith attempt to implement controls and heed their guidance. Partner for the win – use your auditor to “block and tackle” client requests that seem like overkill, such as clients asking you to get SOC 2 certified in all five Trust Services Categories when the vast majority of companies need at most one to three categories.

Remote Compliance is Possible

In the midst of growing a business during COVID-19, audit compliance remains extremely important. The stakes are high. Work-from-home requirements make the evidence collection process even tougher, but it is still entirely possible to be audit-ready during this time. Put one person in charge of the process and focus on a limited number of controls.

Centralize your evidence and make friends with your auditor, who is actually on your side and will work with you – not against you – to help you pass your audit. These best practices will help you lead a company that is not only growing, but also compliant, removing at least one stressor from your plate and making more room in your mind for innovative and strategic thinking.


Previous Post

Hanzo Hold Complements Slack Legal Data Management with the Release of G Suite (Google Workspace) Support

Next Post

The 7 Principles of Ethical Leadership

Patrick Murray

Patrick Murray

Patrick Murray is Chief Product Officer and early founding member of Tugboat Logic, the Security Assurance Platform that helps demystify and automate the process of managing your InfoSec program. He has over 20 years of experience in product management at both early-stage security startups and public companies such as Zenprise, DataVisor, and Websense. He specializes in building new companies from the ground up to thriving businesses and has built products across a variety of security areas including Web security, cloud security, mobile security, email security, data loss prevention, and online fraud prevention.

Related Posts

Fox_DOJ Speeches_f

Analysis of Recent DOJ Statements

by Corporate Compliance Insights
March 23, 2023

DOJ leaders provide insight into agency's plans. Analysis of Recent Statements DOJ Shaping the Future of Corporate Criminal Enforcement What’s...

Fox_2023 ECCP Update_f

2023 Evaluation of Corporate Compliance Programs

by Corporate Compliance Insights
March 23, 2023

Keeping up with 2023 changes to DOJ guidelines. Additions, Deletions & Changes From 2020 2023 Evaluation of Corporate Compliance Programs...

encompass update

Encompass Launches pKYC Maturity Model

by Corporate Compliance Insights
March 22, 2023

KYC automation platform Encompass has unveiled a new perpetual Know Your Customer (pKYC) maturity model designed to help banks improve...

consilio onna partnership

Consilio, Onna Seek to Streamline eDiscovery for Cloud Apps

by Corporate Compliance Insights
March 22, 2023

Legal technology provider Consilio has launched a new platform, Sightline Collect, powered by data management supplier Onna. The platform is...

Next Post
edison bulb

The 7 Principles of Ethical Leadership

Compliance Job Interview Q&A

Jump to a Topic

AML Anti-Bribery Anti-Corruption Artificial Intelligence (AI) Automation Banking Board of Directors Board Risk Oversight Business Continuity Planning California Consumer Privacy Act (CCPA) Code of Conduct Communications Management Corporate Culture COVID-19 Cryptocurrency Culture of Ethics Cybercrime Cyber Risk Data Analytics Data Breach Data Governance DOJ Download Due Diligence Enterprise Risk Management (ERM) ESG FCPA Enforcement Actions Financial Crime Financial Crimes Enforcement Network (FinCEN) GDPR HIPAA Know Your Customer (KYC) Machine Learning Monitoring RegTech Reputation Risk Risk Assessment SEC Social Media Risk Supply Chain Technology Third Party Risk Management Tone at the Top Training Whistleblowing
No Result
View All Result

Privacy Policy

Founded in 2010, CCI is the web’s premier global independent news source for compliance, ethics, risk and information security. 

Got a news tip? Get in touch. Want a weekly round-up in your inbox? Sign up for free. No subscription fees, no paywalls. 

Follow Us

Browse Topics:

  • CCI Press
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks Published by CCI
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • GRC Vendor News
  • HR Compliance
  • Internal Audit
  • Leadership and Career
  • On Demand Webinars
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Well-Being
  • Whitepapers

© 2022 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe

© 2022 Corporate Compliance Insights

Welcome to CCI. This site uses cookies. Please click OK to accept. Privacy Policy
Cookie settingsACCEPT
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT