Up next in our Ask the Expert series, Ben Rothke, Senior Information Security Manager, reviews two certifications that should be part of your information security strategy: Service Organization Control (SOC) 2 Type 2 and International Organization for Standardization (ISO) 27001. Tapad, a part of Experian, is 27001 and SOC 2 Type 2 compliant.
Two information security certifications you can trust
Seals from Good Housekeeping and Underwriters Laboratories give consumers confidence that they can trust the product that they’re buying. For IT solutions or service providers, what, or who can you turn to for that seal of approval? There are many equivalent third-party attestations you can use. But which should you trust?
- The International Organization for Standardization (ISO) 27001
- The American Institute of Certified Public Accountants (AICPA) System and Organization Controls (SOC)
International Organization for Standardization (ISO)
27001 is an international standard for information security from the ISO. ISO 27001 is globally acknowledged and sets requirements for controls, maintenance, and certification of an information security management system (ISMS). This international standard provides organizations with a framework to identify, manage and reduce risks related to the security of information
System and Organization Controls (SOC)
The SOC, as defined by the AICPA, is a set of audit reports. SOC reports, like 27001 certificates, are used by service organizations to give their customers the confidence they have adequate information security controls in place to protect the data that they handle.
SOC 2 is an assessment of controls at a service organization regarding security, availability, processing integrity, confidentiality, and privacy. The purpose of the report is to provide extensive information and assurance to a broad range of users about the controls at a service organization that are relevant to the security, availability, and processing integrity of the systems that process user data, as well as the confidentiality and privacy of the information processed by these systems.
Why ISO 27001 and SOC 2 are important
The value of these third-party attestations is two-fold:
- Organizations can show they have passed an independent external audit
- Third-party attestations save organizations the time of having to do their own audits
In addition to 27001 and SOC 2 Type 2 compliance, we are also certified with ISO 27017 and 27018, which are add-ons to 27001 that are specific to cloud computing. We take the security and privacy of our customers’ data as seriously as they do.
Every cloud service provider (CSP) has a responsibility matrix that details what security and privacy tasks they are responsible for and which ones the customer is responsible for. Any cloud customer that needs to be made aware of what their security tasks are is putting themselves at risk.
So, when you want to engage a CSP, ask them for their attestations. They worked hard for them and will be proud to share their compliance.
We’re powered by decades of setting standards in marketing services
At Experian, we’re a privacy-first business. We’re highly focused on respecting people, their data, and their privacy. We continue to show our dedication to information security by completing these security audits every year.
The constant changes to data compliance regulations can be challenging to navigate, but you don’t have to do it alone. Contact us today. We will be your guide so you can ethically and confidently reach your customers.
About our expert
Ben Rothke, Senior Information Security Manager
Ben Rothke, CISSP, CISA, is a Senior Information Security Manager at Tapad, a part of Experian. He has over 25 years of industry experience in information systems security and privacy. His areas of expertise are in risk management and mitigation, security and privacy regulatory issues, cryptography, and security policy development. Ben is the author of Computer Security – 20 Things Every Employee Should Know (McGraw-Hill), and writes security and privacy book reviews for the RSA Conference Blog and Security Management magazine.
Latest posts
The holiday season is right around the corner and retailers are gearing up for a massive influx of customers, both new visitors and returning loyal patrons. But, organizations need to make sure they’re prepared to handle the influx of business. Data quality should be a priority for retailers at any time of year, but even more so as the holiday season approaches. During this time, it’s important for companies to provide customers with relevant shopping offers. When consumers shop for holiday gifts for their friends and families, they have countless directions to which they can turn. In order to prevail in competition, retailers need to provide customers with relevant offers and messages. Unfortunately, many businesses fall short in this regard. According to recent research from Experian QAS, organizations feel that, on average, 25 percent of their data is inaccurate. Consumers are frantically looking to find deals on products that meet their holiday needs, but loyalty offers may not be reaching consumers. One reason for the difficulty is the messy nature of companies’ customer databases. Retail businesses are working hard to gather as much information as possible about the consumers who patronize them, but all too often, information is riddled with errors. These errors have become more prevalent in recent years due to the proliferation of mobile apps, web interfaces and social media channels. There are so many different channels that companies now interact with people through an average of 3.27 channels. This poor data quality is hurting organizational bottom lines. Experian QAS found that an average of 12 percent of departmental budgets are wasted due to inaccuracies in contact data. During the 2013 holiday season, consumer spending is expected to increase by at least 11 percent. Retailers need to be certain that they improve data quality prior to the holiday season to ensure communications reach consumers and resources are maximized in order to take advantage of the expected increase. Be sure to check out our new data quality infographic.
Experian Marketing Services’ Head of Global Research Bill Tancer appeared recently on Fox Business News to talk about new holiday shopping trends, including why both retailers and consumers are starting the 2013 season earlier this year. “We are seeing the eventual extinction of Black Friday,” says Tancer. “What we see in our data is that retail is really changing. The consumer is relentlessly searching for that deal.” In fact, as Tancer notes, the hyper-connected, digital consumer is already searching for holiday deals. Hear more from Tancer in this clip. Watch the latest video at video.foxbusiness.com Tancer and other Experian Marketing Services data experts will discuss holiday marketing trends at an upcoming webinar; register for more insights and tips.
On some level, collecting data and analyzing it to find meaningful conclusions has always been part of how marketers go about connecting with consumers. Their strategies have improved dramatically over time, though. Perhaps in a previous era, marketing executives were only able to make sweeping generalizations about large swathes of the population. But, as marketers have gathered more data on individual consumers, they’ve found ways to fine-tune their searches. They’re no longer messaging to groups in vague terms. Smart Data Collective recently examined the marketing world’s transition away from broad stereotyping toward better targeted forms of data mining. Josh Brown, a member of the marketing team at business and IT consulting company Iconic Mind, argues that this era of overgeneralization is coming to an end. We now have the capability to zoom in on the specific customer. “Big data is how successful companies are building more detailed models of consumer behavior,” Brown wrote. “Instead of relying on the traditional demographic models that marketers used when we were operating in a mass consumption environment and had nothing better, big data capitalizes on developing market trends to allow businesses to become far more specific when segmenting their customers.” Brown cited Amazon.com as an example. The online superstore is notable for its targeted recommendations of products that shoppers see every time they log on to the site – the advisements are impressive because they’re usually right up the customer’s alley. Amazon doesn’t generate these ideas by making guesses based on whether the consumer is old or young, male or female – instead, the site takes in specific information about people’s buying histories and looks for similar products. This approach is quickly becoming mainstream. It’s not hard to understand why – people don’t like being reduced to profiles of their demographic characteristics. Consumers are expecting more from the companies they do business with. Thanks to the rapidly improving technologies that companies use for data collection, marketers can be more targeted and make more intelligent interactions. However, to take advantage of these new technologies, marketers need to maintain high quality data. Without a data quality strategy, customer information will be spread out across the organization, making it difficult to make intelligent marketing offers. To learn more about improving your understanding of consumers, check-out our infographic on building a single customer view.