SOC Examination: Is there a SOC certification similar to an ISO 27001 certification?
Is there a SOC certification similar to an ISO 27001 certification?
SOC reporting actually is not considered a certification. As the SOC reports are performed under AICPA attestation standards, they are considered attestation reports. The attestation reports provide an opinion by an independent practitioner/auditor attesting to certain elements about the control environment of a service organization, depending on the SOC report or attestation standard. This is different than an ISO certification that determines an organization’s conformity of their information security management system (ISMS) to the ISO 27001 standard.
About DEBBIE ZALLER
Debbie Zaller is Chief Operating Officer at Schellman. Debbie is responsible for maintaining and driving operational results and executing the firm's strategic goals. Debbie oversees all daily operations of the firm while spearheading the development, communication and implementation of effective growth strategies and processes. Debbie has over 21 years of IT compliance and attestation experience. Debbie led the firm's Midwest, Southeast, and Northeast regions along with the national service lines of SOC 2 and Privacy service lines as Managing Principal before assuming the position of COO in 2021. Debbie holds a Master of Accounting degree from the University of Florida. She is a Certified Public Accountant, Certified Information Privacy Professional/United States, Certified Data Privacy Solutions Engineer, Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Cloud Security Knowledge. She is currently an AICPA-approved and nationally listed SOC Specialist and speaker on various privacy topics. Debbie was on the AICPA Task Force for the Advanced SOC for Certification Exam, was a member of the Florida Institute of Certified Public Accountants Board of Governors and served on the Finance and Office Advisory Committee.