Quick answer A SOC 2 report must be signed by an independent firm licensed to report under AICPA standards – for example specialist CPA firms such as A-LIGN or Thoropass, or a Big 4 network (Deloitte, EY, KPMG) through a member firm that can sign. Always ask which entity signs the report. Before that audit, […]
QUICK ANSWER Indian pharma and healthtech companies are adopting ISO 27001 because three pressures now arrive together. ISO 27001 does not replace GxP, but it gives these pressures a single, auditable security management system. The three drivers are: The DPDP Act and Rules, which require reasonable security safeguards and breach reporting from 14 May 2027. […]
Internal vs external penetration testing comes down to one question: where does the attacker start? An external penetration test simulates an attacker on the internet targeting your public-facing systems, while an internal penetration test simulates someone who is already inside your network, such as a compromised laptop, a malicious insider or a visitor on your […]
Yes, certified companies get breached, and it happens more often than most compliance programs like to admit. ISO 27001 and SOC 2 certificates prove that controls existed and were documented at the time of the audit. They do not prove those controls are still working today, against the attack techniques being used right now. That […]
If you are asking how often penetration testing should happen, the short answer is more than once a year. A single annual pentest only captures your security posture on the day it runs. New vulnerabilities, new code releases, and new staff and vendor access appear every week after that, which means an annual-only testing schedule […]
The Essential 8 maturity levels measure how well an organisation has implemented the Australian Cyber Security Centre’s eight mitigation strategies, ranked from ML0 (not yet implemented) to ML3 (fully mature against sophisticated adversaries). Most Australian government contracts and critical infrastructure obligations require at least ML1, with ML2 and ML3 expected as risk and regulatory exposure […]
Quick Answer Auditors generally accept vulnerability scanning as evidence of routine detection controls, but only penetration testing satisfies requirements for validated, exploit based assurance. ISO 27001, SOC 2, PCI DSS, and the ACSC Essential Eight each expect scanning on a continuous or quarterly cadence, with penetration testing performed at least annually or after significant system […]
Quick Answer Yes. If you send customer data to an AI API such as OpenAI, Anthropic, or a third-party AI feature embedded in a SaaS tool, that provider is a subservice organisation and falls inside your SOC 2 scope. Auditors expect you to identify every AI vendor touching in-scope data, document the nature of that […]
Quick Answer Most Australian businesses need VAPT (vulnerability assessment and penetration testing), not red teaming. VAPT finds and lists vulnerabilities across your systems on a fixed scope and timeline. Red teaming tests whether your people, processes, and detection capability can catch a realistic, multi-stage attack, and only delivers value once you already have basic security […]
Quick answer The right ISO 27001 consultant will name your lead auditor, give you a written scope and timeline before any payment, and stay involved through post-certification surveillance audits. If they cannot answer these three points clearly, keep looking. The 10 questions and red flags below cover everything else worth checking before you sign. Choosing […]
