Best Practices Series

AssuranceLab's Guides

Our Best Practices Series is about finding harmony between your compliance goals and fit-for-purpose business practices. Meeting the requirements of industry standards while achieving real operational benefits.

We explore why the 'best practices' are important, and how you can implement the right approach for your unique business, culture, and context.

'Process-Light Compliance'

Can you be agile and compliant?

As the leading provider of SOC 2 reports to SMB SaaS businesses in Asia-Pacific, we get a lot of questions about how to achieve InfoSec compliance in a 'process-light' or 'fit-for-purpose' way.

Can you achieve SOC 2 and other standards without being 'process-heavy' and over-burdening your business with 'compliance'?

Control Environment

The control environment supports the broad business objectives through people, governance and management activities.

Code of Conduct

This little 'compliance' document can resolve some tricky situations, and even enable your desired culture.

Talent Management

Finding, developing and retaining talent in your people investment to achieve your business objectives.

Employee Onboarding

Starting your employees off on the right foot, aligning to your culture and objectives, and clarity of expectations.

Information & Communication

Collecting and using the right information to effectively manage your operational practices and communicate with internal and external stakeholders.

I&C Checklist

There's a broad range of practices that lay the foundation for effective information & communication.

Customer Comms

Effective communication is a necessity to building long term users, but also improving security outcomes.

System Boundaries

The system boundaries identify and communicate where responsibility shifts to your customers and vendors.

Risk Management & Internal Controls

Defined processes and practices for identification, assessment and response to risks that threaten your objectives, and your controls to manage those risks.

Vendor Management

The basic processes to manage third-party providers protects your business and customers interests.

Risk Management

A defined approach to your risk management transforms this intuitive practice into an enabler of your success.

Control Framework

The control framework puts formal ownership and monitoring in place to achieve effective control practices.

System Security

System security covers the technical security protections and surrounding processes to ensure access to sensitive data is limited to the right people.