ISO 27001 and SOC 2 both prove you manage information security, but they suit different markets. Here’s the difference, and how one system can support both.
Information security and cyber
ISO 27001 Controls Explained (Annex A, 2022)
ISO 27001:2022 Annex A lists 93 controls across four themes. Here’s what they are, whether you must implement all of them, and how the Statement of Applicability works.
The Essential Eight Explained (Maturity Levels 0-3)
The Essential Eight is the ACSC’s baseline set of cyber mitigation strategies. Here’s what the eight are, how the maturity levels work, and how it relates to ISO 27001.
What is TISAX? The Security Standard for Automotive Suppliers
TISAX is the automotive industry’s information security assessment, based on the VDA ISA and aligned to ISO 27001. Here’s what it is, the assessment levels, and how to prepare.
Microsoft Launches Defender Experts Suite: What It Means for Australian Businesses
Microsoft’s Defender Experts Suite is built around Microsoft’s managed detection and response (MDR) service: in plain terms, Microsoft’s own security analysts watching your environment and hunting for threats using the signals your Microsoft 365 and Defender licences already generate. For the many Australian businesses running on Microsoft but without a 24/7 security team, it’s a […]
Australian Government Cyber Security Policies: A State-by-State Guide
Every Australian government now has a cyber security policy for its own agencies, and most have rewritten theirs in the last two years. If you are a government agency, these policies set your minimum controls and your annual reporting. If you supply services to government, they matter almost as much: the requirements flow down into […]
ASD Wants Critical Infrastructure Isolated for 3 Months. What If You Supply It?
ASD asks critical infrastructure operators to run isolated for three months. If you supply them, your access is cut first. What it means for ISO 27001.
What is SOC 2? A Plain-English Guide for Australian Businesses
SOC 2 is a US attestation report on your security controls, increasingly asked for by US customers. Here’s what it is, Type I vs Type II, and how to get it from Australia.
How to Review a Supplier’s SOC 2 Report
How to review a supplier’s SOC 2 report: the opinion, scope and period, subservice providers, complementary user controls, exceptions and red flags.
SOC 2 Bridge Letters: What They Are and What Goes in One
What a SOC 2 bridge letter is, who signs it, how long it can cover, what it should contain and when customers ask for one.
- « Previous Page
- 1
- 2
- 3
- 4
- …
- 8
- Next Page »
