Glenard has more than 15 years’ experience in implementing and Auditing “Best Practice” Frameworks, and Standards such as CoBIT 5, ITIL V3, ISO 27001 – Information Security Management System and ISO 9001 Quality Management System

Qualifications:

Certified ITIL Expert

Certified CoBIT Assessor

Certified ISO 27001 Lead Auditor

Certified ISO 9001 Lead Auditor

DevOps Practioner

References include: 

Implementation of ITIL in the Ministry of Finance and Office of the Prime Minister in Namibia where 16 Government Employees were trained and Certified as ITIL Experts

Establishment of GRC in accordance with Public Service Administration in Namibia

In collaboration with DD Limpopo, establishment of DPSA CGICT defined Core Practices at the then, newly established Collins Chabane Local Municipality

Implementation of ISO 27001 Information Security Management for QR-Connect in the Netherlands and Zafehouze ApS in Denmark.

Comparison between ISO 27001:2022 and SOC

ISO 27001:2022 Revision defines requirements and Controls for the systematic Protection of Information, including PII which are Applicable to Organizations/Entities of any size across Industries that require Compliance with the Standard.

The Information Security Management System (ISMS), defined in Clauses 4 through 10 of the Standard, provides Directives to Organizations/Entities as to provide Guidance to ensure its Security Compliance are aligned with identified/adopted objectives and outcomes (eradication/mitigation of Threats as a result of incidents, operational optimization, etc.), predicated upon an EFFECTIVE Risk Management approach.

What is the relationship between ISO 27001:2022 and SOC?

ISO 27001 has at a minimum the following controls that can be used to comply with the Trust Services Criteria:

ISO 27001 vs SOC

It is not a question of whether ISO 27001 vs. SOC 2, as SOC is an Audit report, while ISO 27001 is a Standard to establish an Information Security Management System (ISMS)

Hence SOC can be considered as an output, delivered by an ISO 27001 ISMS Implementation.

In effect the appropriate relationship between ISO 27001 and SOC is as follows:

1.ISO 27001 Certification is not Mandatory to create an SOC report

2.The ISMS can provide, without major additional cost and effort, a solid basis for preparing this report, whilst increasing Clients/Customers’ confidence that the Organization can Protect their Information/Data.

What is the difference between ISO 27001 and SOC?

ISO 27001 is the Standard that establishes requirements for an Information Security Management System (ISMS), a set of practices to define, implement, operate, and improve information security.

While SOC refers to a set of audit reports to evidence the level of Conformity of Information Security Controls’ design and operation against a set of defined criteria (TSC),

Definition. 

ISO 27001 is a Standard that establishes requirements for an Information Security Management System (ISMS).

SOC refers to a set of audit reports to evidence the level of conformity to a set of defined criteria (TSC),

Applicability by industry. 

ISO 27001 – for Organizations of any size or industry.

SOC 2 – for Service Organizations from any industry,

Compliance. 

ISO 27001 is certified by ISO certification body.

SOC 2 is attested by a licensed Certified Public Accountant (CPA),

What are the Objectives?

ISO 27001 – to define, implement, operate, control, and improve overall security.

SOC 2 is intended to prove Security level of Systems against static principles and criteria