An ISO 27001 certification can help your business stand out. It lets your customers and potential customers know you care about and will protect their information. It can also help you streamline internal processes.

According to the Identity Theft Resource Center, we saw 781 data breaches in 2015 that totaled hundreds of millions of stolen records, many of which included personally identifiable information about customers—names, addresses and Social Security numbers.

As organizations grow and expand their client base, especially in regulated or security-conscious industries, the demand for third-party assurance has never been higher. It’s common to be faced with requests for both an ISO 27001 certification and a SOC 2 report, but you may be wondering if they are really different. Companies often ask, “can my ISO 27001 certification cover what’s needed for SOC 2?” or “do I really need both?”

Securing top management’s support is essential for the success of critical information security initiatives. Leadership buy-in drives the prioritization of security standards and best practices and helps to cultivate and foster a strong company-wide commitment to security-focused compliance.

Undoubtedly, the ISO 27001 Certification is recognized globally and revered as one of the highest and most comprehensive certifications an organization can attain. The high esteem that the certification is held is substantiated by the effort and dedication that is required by an organization to attain ISO 27001 certification. As an internationally accepted certification, ISO 27001 represents an organization's ability to effectively manage information security risks with a certified information security management system (ISMS).

If your organization is seeking ISO 27001 certification, and you outsource physical hosting to a third-party vendor, you may be wondering if and how to include them in the scope of your Information Security Management System (ISMS).

In October, I posted an article on the various alternatives for CPA attestation reports. This past week, the AICPA issued its guidance on Service Organization Controls (SOC) 2 reports and an update to that post was in order. Here is what the newly released SOC 2 guidance states: