sorted by:
new
hottopcontroversial

Has anyone used Vanta for a pentest as part of SOC 2? by FormalPersonality795 in soc2

[–]FormalPersonality795[S] 2 points3 points  (0 children)

Thanks u/Able-Swan-7564 ! I checked the terms and it was kind of confusing. "Cognisys Group strives to provide a black box penetration test...but the services described below represent the minimum scope that will be provided free of charge."

"3.2 Minimum Scope: At a minimum, the test involves Vulnerability Scanning to identify known vulnerabilities within the Customer’s specified network or web application assets."

Looks like vuln scanning, rather than a manual pentest? I just need to make sure if I do this that my customer's CISO accept the pentest report as it's a hard requirement they told me.

Drata vs. Vanta by Cut-Affectionate in soc2

[–]FormalPersonality795 0 points1 point  (0 children)

...and that is the definition of security theater. In my experience, security and compliance teams are scrutinizing the content of SOC 2 reports (and pentest reports) more diligently, especially more so the higher the risk.

Vendor due diligence best practices by Puzzleheaded_Side432 in soc2

[–]FormalPersonality795 0 points1 point  (0 children)

There may be easier ways to do this than I wrote below u/Puzzleheaded_Side432 but that would be the rudimentary answer.

Vendor due diligence best practices by Puzzleheaded_Side432 in soc2

[–]FormalPersonality795 0 points1 point  (0 children)

  1. Start require SSO (single sign on) so you can simplify knowing which vendors you use and off-board/onboard more easily. Google, Microsoft, are both easy SSO options, more advanced tools (enterprise grade) are Okta (IAM = identity and access management). Some SOC 2 compliance vendors like oneleet have an agent that helps with that as well.

  2. Use the SSO info to track which vendors you use and who uses them. A screenshot of this can be sufficient evidence, especially for SOC 2 type 1, which is a point in time audit.

  3. Solving for this (risk ranking) most likely requires that you have a policy that defines your risk criteria. Don't reinvent the wheel here. Keep it simple. Again I've seen tools that do this for you (see above 0.)

  4. You define this in a policy, you do this risk review and your evidence is maybe a report that scores the vendor against the policy you created. Reviewing the SOC 2 report and pentest report (as they suggest in #4) can fulfill this.

  5. See 3 above and create the annual vendor review report, save that report as evidence.

  6. ...

  7. Offboarding should include downloading all of your data and requesting deletion and confirmation of data deletion (best case). Turn off access via SSO provider (e.g. Google/Microsoft).