SOC 2 Compliance

Requirement CC6.8:

The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives. 

• Uses a Defined Change Control Process—A management-defined change control process is used for the implementation of software. 
• Uses Antivirus and Anti-Malware Software—Antivirus and anti-malware software is implemented and maintained to provide for the interception or detection and remediation of malware. 
• Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Software—Procedures are in place to scan information assets that have been transferred or returned to the entity’s custody for malware and other unauthorized software and to remove any items detected prior to its implementation on the network.

Requirement CC7.2:

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity’s ability to meet its objectives; anomalies are analyzed to determine whether they represent security events. 

• Implements Detection Policies, Procedures, and Tools—Detection policies and procedures are defined and implemented and detection tools are implemented on infrastructure and software to identify anomalies in the operation or unusual activity on systems. Procedures may include (1) a defined governance process for security event detection and management that includes provision of resources; (2) use of intelligence sources to identify newly discovered threats and vulnerabilities; and (3) logging of unusual system activities. 
• Designs Detection Measures—Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software. 
• Implements Filters to Analyze Anomalies—Management has implemented procedures to filter, summarize, and analyze anomalies to identify security events.

How Blumira Helps: Blumira automates the monitoring of an organization’s environment to help identify anomalies indicative of malicious acts and operational errors, analyzing them with detection rules designed to determine if they are a security event. Blumira has rules that identify potential use of compromised credentials, unauthorized access, connection of unauthorized software and more.

Requirement CC7.3:

The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures. 

• Communicates and Reviews Detected Security Events—Detected security events are communicated to and reviewed by the individuals responsible for the management of the security program and actions are taken, if necessary.
• Develops and Implements Procedures to Analyze Security Incidents—Procedures are in place to analyze security incidents and determine system impact. 
• Assesses the Impact on Personal Information—Detected security events are evaluated to determine whether they could or did result in the unauthorized disclosure or use of personal information and whether there has been a failure to comply with applicable laws or regulations. 
• Determines Personal Information Used or Disclosed—When an unauthorized use or disclosure of personal information has occurred, the affected information is identified.

How Blumira Helps: Blumira automates the monitoring of an organization’s environment to detect anomalies and analyze them with detection rules designed to determine if they are a security event. With Blumira Agent, the platform takes automated action to isolate (contain) affected devices and cut off network access to help prevent further attacker damage. Blumira sends alerts to organizations to notify their teams of prioritized and critical security events, with instructions on how to take action and respond.

Requirement CC7.4:

The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate. 

• Mitigates Ongoing Security Incidents—Procedures are in place to mitigate the effects of ongoing security incidents. 
• Ends Threats Posed by Security Incidents—Procedures are in place to end the threats posed by security incidents through closure of the vulnerability, removal of unauthorized access, and other remediation actions. 
• Obtains Understanding of Nature of Incident and Determines Containment Strategy—An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach. 
• Remediates Identified Vulnerabilities—Identified vulnerabilities are remediated through the development and execution of remediation activities.

Requirement CC7.5:

CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents. 

• Determines Root Cause of the Event—The root cause of the event is determined. 
• Implements Changes to Prevent and Detect Recurrences—Additional architecture or changes to preventive and detective controls, or both, are implemented to prevent and detect recurrences on a timely basis.

How Blumira Helps: Blumira supports security incident response programs by providing context and an analysis description of the event, along with automated containment options and playbooks for how to respond. Blumira also keeps a tamper-proof record of logs, providing a year of data retention, ideal for supporting incident investigation and meeting compliance/cyber insurance requirements. Blumira Investigate allows for easy and fast search of all logs to find data and help determine the scope of an incident, and assist with determining the root cause of the event.

Requirement CC4.1: COSO Principle 16

The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. 

• Considers a Mix of Ongoing and Separate Evaluations—Management includes a balance of ongoing and separate evaluations. 
• Considers Rate of Change—Management considers the rate of change in business and business processes when selecting and developing ongoing and separate evaluations. 
• Establishes Baseline Understanding—The design and current state of an internal control system 
• Considers Different Types of Ongoing and Separate Evaluations—Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments.

How Blumira Helps: Blumira helps support this control by providing pre-built compliance reports that organizations can use to conduct internal audit assessments, or provide to external auditors. These reports can be scheduled to run and export periodically over time. This can help prove that internal controls are present and functioning, and allow organizations to evaluate the effectiveness of controls or use the data to help inform how they can improve their controls.

Requirement CC5.2: COSO Principle 11

The entity also selects and develops general control activities over technology to support the achievement of objectives. 

• Establishes Relevant Technology Infrastructure Control Activities—Management selects and develops control activities over the technology infrastructure, which are designed and implemented to help ensure the completeness, accuracy, and availability of technology processing. 
• Establishes Relevant Security Management Process Controls Activities—Management selects and develops control activities that are designed and implemented to restrict technology access rights to authorized users commensurate with their job responsibilities and to protect the entity’s assets from external threats. 
• Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities—Management selects and develops control activities over the acquisition, development, and maintenance of technology and its infrastructure to achieve management’s objectives.

Requirement CC9.1:

The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

• Considers Mitigation of Risks of Business Disruption—Risk mitigation activities include the development of planned policies, procedures, communications, and alternative processing solutions to respond to, mitigate, and recover from security events that disrupt business operations. Those policies and procedures include monitoring processes, information, and communications to meet the entity's objectives during response, mitigation, and recovery efforts.

How Blumira Helps: To mitigate risk, Blumira automates threat detection and provides response playbooks with instructions on how to respond to specific events and help prevent further damage and future attacks.