Thank You for Choosing BARR Advisory

What You Provide

During the SOC examination kickoff phase, BARR will work with your team to collect a number of items that will help us during your assessment. 

• Complete your system description. The system description provides an overview of your company’s operations and control environment for the in scope system. 
• Review control wording. Controls are documented processes in your environment relevant to your in scope system that helps achieve your in scope trust service criteria. BARR will provide you with template controls to test during the engagement. It is important that you review the controls and modify them to reflect your current control environment. 
• Provide information requests. BARR will request documentation via our tool called taskBARR. Information requests must be submitted within predetermined timeframes that will be established by the engagement team. 

What BARR Provides

We are committed to guiding you through this process by providing unparalleled support.

• During the engagement kickoff meeting and in the weeks that follow, we will provide the support and knowledge you need to complete your engagement. 
• We will review information requests as they come in and hold walkthrough meetings with you to gain an understanding of your control environment and ensure we obtain the correct documentation to evidence your compliance with applicable trust services criteria. Any issues we identify will be reported to you immediately and we will work with you to identify possible solutions. 
• At the conclusion of our fieldwork, we will issue a draft report or certification for your team to review and provide feedback. 

Readiness Assessments

If this is your first audit, or you’d like an analysis of the potential challenges that might arise when implementing new processes, the readiness assessment is right for you. 

While optional, the readiness assessment ensures that your examination will go as smoothly as possible. Through this period, you’ll engage in three specific meetings with your lead and correct gaps prior to starting the audit period.

Examination Engagement

While we cater our services to meet your specific needs, here’s a condensed timeline on what to expect from your engagement team: 

• Plan: A kickoff call is scheduled with you to confirm we are on the same page with the scope, timelines, deliverables, and personnel needed for the assessment.
• Assess: Walkthrough duration is dependent on your environment complexity and size; however, four hours is the typical time commitment.
• Report: BARR will provide a draft report no later than 30 days after the period ends. 
• Celebrate & Optimize: BARR will provide a promotional package and schedule a debrief to review improvement opportunities for your security program, rate the engagement, and plan your next engagements

For more information, see each step of our SOC 2 Engagement Process.

SOC Reports

Once your audit is complete, you’re ready to receive your report. BARR provides reports for SOC 1, 2, 3, and SOC for Cybersecurity. For each report, you can choose a Type 1 or Type 2.

• Type 1 reports may be performed right away if your organization has your controls in place and documented. These reports offer a point-in-time service, testing your design on a specific date.
• Type 2 reports are generally audited over a 3 to 12 month period. These reports reflect your organization’s operating effectiveness during the course of a review period and provide a more detailed assessment of your controls.

Promotional Package

Once you complete your SOC examination, BARR will provide you with a promotional package that you can share with your customers, partners, and other company stakeholders. This reassures them their data is safe with you and differentiates your organization from the rest.

Popular Blogs

• SOC 2 vs. SOC for Cybersecurity
• How Long Are SOC Reporting Periods? Here’s What to Expect
• Understand the Key Differences Between ISO 27001 vs. SOC 2 and Why You Might Need Both
• Preparing for Your SOC 2 Audit Journey
• SOC 2 Trust Service Criteria: What They Are and How to Select the Right Ones

Videos

• How to Achieve an ISO 27001 Certification and a SOC 2 Report with BARR
• How to Scale Your Startup with a SOC 2
• Common SOC Exceptions

Case Studies

• SOC 2 Leads OnRamp to Rapid Growth and an Increase in Business Deals
• E-commerce Platform Convictional Utilizes SOC 2 to Grow Business and Cut Sales Cycle in Half
• RFP360 Uses BARR Advisory and Vanta to Simplify the SOC 2 Process

The cybersecurity consulting team helps our clients establish security programs that are flexible and adaptive to the needs of their business stakeholders. This includes a common structure to safeguard information assets and streamline business deals with customers’ security demands. Our approach includes the phases, activities, and deliverables below:

Gap Assessment

We believe in determining the why before proposing the how and that careful planning and thorough identification of gaps are imperative to achieve your security objectives.

During the gap assessment phase, which typically takes 1-2 months to complete, BARR: 

1. Determines the scope of your organization;
2. Assesses your organization against a given framework or standard; and,
3. Provides you with a list of specific gaps and recommendations to prioritize and remediate.

After you complete an initial gap assessment, the BARR team will work with you to remediate any gaps. Our goal in Phase 2 is to take the client from a posture with gaps to at least a level of compliance with the given framework(s) or standard(s). 

This includes establishing a security committee, ensuring all gaps and recommendations progress toward remediation and that all deliverables are finalized, and defining a sustainable security plan for a long and short-term information security program. For more information, see our consulting engagement process.

Security Roadmap: We work with you to create a successful roadmap toward remediation, turning what were gaps in our clients’ security programs into competitive advantages.

Continuous Management: With the continuous support of a virtual CISO, we provide a valuable strategic asset. We weave security and compliance into the DNA of our clients’ organizations, differentiating them from their competition.

Popular Blogs

• Security Awareness Training: How to Implement a Role-Based Training Program
• How to Build a Third-Party Risk Management Strategy
• Continuous Compliance Monitoring: A Must-Have Strategy

Videos

• The 411 on Security Questionnaires
• Shaping Up Your Security Posture
• Implementing an Information Security Program

Case Studies

• Cybersecurity Consulting Establishes a Security Roadmap for Jackpocket + ‘Light Speed’ Growth
• vCISO Advisory Services Lead Ceros to SOC 2, ISO Audit, and 200+ Closed Deals

Whitepapers

• In the Trenches: Building A Risk Management Program from the Ground Up
• How to Establish Your Vision and Gain Cybersecurity Traction
• How to Implement an Information Security Program in 9 Steps

BARR experts will guide you through every step of the PCI DSS process. The following steps can be helpful to prepare for your engagement:

• Understand your CDE segmentation: Understanding your CDE segmentation is often referred to as “requirement zero.” To do this, it’s helpful to maintain current network diagrams that reflect how data is transmitted, processed, and stored. This will help limit your scope prior to your engagement.
• Understand your requirements: Are you a service provider or a merchant? Protect yourself from last-minute surprises by recognizing any specific requirements that may apply to your organization.
• Know your transaction amount: Organizations are held accountable on the number of transactions handled annually. Prepare for your audit by having these numbers readily accessible.

While we cater our services to meet your specific needs, here’s what to expect from your engagement team:

Plan: The planning phase of PCI DSS compliance helps BARR and your organization set expectations for your PCI engagement.

Assess: At least three months prior to your PCI compliance report date, BARR will hold a kickoff meeting to finalize the engagement plans and ensure you’re as prepared as possible. Your organization will then respond to evidence requests that are customized to your unique CDE through BARR’s audit portal, and your engagement team will conduct the testing and gathering process—including policy reviews, system evidence reviews, interviews, and observations.

Report: Depending on your organization’s transaction amounts and customer requests, you can choose to perform a self-assessment questionnaire (SAQ) or a report of compliance (RoC). If you choose to perform an RoC, BARR will draft the report along with an attestation of compliance (AoC), which will be submitted to the appropriate entities for official attestation.

Debrief: Once your report is issued and your audit is archived, BARR will debrief with your organization, communicating process improvement opportunities (PIOs), action items for continuous management, and a pre-plan for your next engagement.

Depending on your organization’s transaction amounts and customer requests, you can choose to perform a self-assessment questionnaire (SAQ) or a report of compliance (RoC). Your organization can complete an SAQ on your own, or you can have a QSA like BARR assist you with the process.

If you choose to perform an RoC, BARR will draft the report along with an attestation of compliance (AoC), which will be submitted to the appropriate entities for official attestation. As your trusted partner and a certified QSA, BARR serves as an official reviewer of these reports—and will give you the opportunity to review them—prior to receiving your final deliverable.

Our reporting services include:

• PCI DSS RoCs and AoCs
• QSA-assisted SAQs and AoCs

Popular Blogs: 

• BARR Advisory Certified as PCI Qualified Security Assessor (QSA) Company
• Understanding PCI DSS: A Guide to the Payment Card Industry Data Security Standard
• PCI DSS 3.2 vs. 4.0—Understanding the Difference and How to Prepare for the Updated Version
• PCI Compliance Explained—Secure Your Credit Card Information Successfully

Whitepapers: 

• Everything You Need to Know About PCI DSS