Auditors test controls in defined stages, and each stage expects specific kinds of evidence. Testing will occur for the different criteria and controls that have been implemented by the service organization. For example, the testing and evidence for availability will be different than that of privacy.
Your System and Organization Controls 2 (SOC 2) is only valid for a year after your audit. If you’re behind on renewing your SOC 2 report and it falls past the date in which it’s valid, you may need a SOC 2 bridge letter. The letter maintains trust with your customers while you renew the report.
Building and maintaining a risk register in Openlane
What a business continuity plan should contain, including roles and response teams, the business impact analysis, recovery metrics (MTD, RTO, RPO), and annual testing requirements
Comprehensive guide to CIS compliance including benchmarks, certification process, and implementation strategies for cybersecurity best practices
Comprehensive guide to Cloud Controls Matrix (CCM) compliance, security controls, and risk management for cloud service providers
Cybersecurity Maturity Model Certification - DoD Framework for Protecting Federal Contract Information and Controlled Unclassified Information
Comprehensive glossary of compliance, security, and GRC terminology including SOC 2, ISO 27001, GDPR, HIPAA, risk management, and audit-related terms and definitions
How to map controls across different compliance frameworks
Publish selected security controls on your Trust Center
What a disaster recovery plan should contain, how to classify critical systems, the notification, recovery, and reconstitution phases, and how to test the plan annually
Share security documentation with Trust Center visitors
Digital Operational Resilience Act - EU Regulation on ICT Risk Management for Financial Entities
Answers to the questions we hear most often about System and Organization Controls 2 (SOC 2): whether it is required, how the attestation works, and what the process costs in time and money.
Federal Risk and Authorization Management Program - US Government Authorization for Cloud Services
Display compliance certifications on your Trust Center
Health Insurance Portability and Accountability Act - Protecting Health Information Privacy and Security
HITRUST CSF - Certifiable Security Framework with e1, i1, and r2 Assessment Tiers
How to import existing controls into Openlane
ISO 27001 compliance for the Openlane platform
ISO/IEC 42001 - International Standard for Artificial Intelligence Management Systems
NIST SP 800-171 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
Overview of NIST 800-53 compliance including security controls, risk management framework, Revision 5 highlights, and implementation guidelines for federal information systems
NIST Cybersecurity Framework - Identify, Protect, Detect, Respond, Recover
NIST Secure Software Development Framework (SSDF) guidelines and the CISA secure software self-attestation form
Open-source compliance automation platform for managing security, risk, and regulatory requirements. Automate SOC 2, ISO 27001, NIST, GDPR, and HIPAA compliance.
Managing your controls within the Openlane platform
Evidence management for compliance programs and audit preparation
What a Program is and how to use it
User groups and access management for compliance teams
Payment Card Industry Data Security Standard - Protecting Cardholder Data
Overview of policies and procedures within Openlane
Which policies each compliance framework expects, and which policies apply universally across frameworks
Comprehensive guide to Sarbanes-Oxley Act (SOX) compliance requirements, internal controls, financial reporting, and audit requirements for publicly traded companies
Comprehensive guide to SOC 2 compliance including Trust Services Criteria, AICPA framework, implementation timeline, costs, and audit requirements for service organizations
What the SOC 2 system description is, the sections auditors expect it to contain, who writes it, when to write it, and how an inaccurate description can affect your audit opinion
Overview of SAMM compliance including maturity levels, assessment framework, and implementation strategies for software security
Customer-facing portal for demonstrating your security posture and compliance status
How to author organizational control language that stays truthful, testable, and stable as your tooling changes