0

I work in InfoSec as an IT auditor and have asked this question on The Workplace SE site some weeks back on how to evaluate anomalies in SOC 2 audit reports. Despite me editing it several times, I am still not receiving responses other than the 1 answer so far.

Before requesting to migrate to this site where I think fellow InfoSec professionals can better help, is it on topic?

1 Answer 1

Reset to default
4

I think one of the reasons why you are getting poor responses is that your question is not very focused. You might get the same type of responses here.

This is what you have said:

  • Prospective vendor has non-standard report
  • You are not sure if you are being overly critical of the vendor
  • How do you communicate caution without making accusations?

The question is simply not a security question, but appropriate for Workplace.SE.

What you seem to want to ask is:

  1. is the non-standard report format valid for SOC 2?
  2. is there a potential security issue?

You know the answer to #1 and we would only point you to the official documentation. There is no way we can answer #2.

So, given these interpretations, your question would not survive if migrated.

But that is not to say that there could be a form of the question that would work. I'm just not clear on what you really want to ask.

3
  • What I want to know is how severe the "anomalies" need to be to consider outright rejection and how to evaluate that decision based on what they will be doing for us. Is this clearer?
    – Anthony
    Mar 8, 2018 at 0:55
  • Yes, this is clearer - but I'm not sure if this new question is something we can help with, either. Whether the anomalies should trigger rejection is up to the standard (we would point you to the documentation) and whether the anomalies should matter to management, is up to management.
    – schroeder Mod
    Mar 8, 2018 at 8:28
  • You don't want to be overly judgmental, so don't be judgemental at all. Explain the facts and the natural consequence of those facts. Leave all judgment and "should" language out of the entire discussion. This is not a security aspect, either.
    – schroeder Mod
    Mar 8, 2018 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .