A client of mine is one the small but specialized University College in South Africa.
Management has identified a weakness in records management and management of information across functional areas and the Academic stream of the institution.
During my environmental scanning of the institution, I concluded that systems integration and information architecture need to be addressed first as a steppingstone towards improving the flow of information to and from the functional areas.
The concept of records management takes a distinctive feature towards information security in this regard. Consequently, matters of risk management become truly relevant to the responsibility conferred on the council of the institution. Logical as it maybe, the ownership of information remain in the hands of the functional heads, yet the health state operational systems and the systems security continue to be the responsibility of the CIO/CISO.
Now, with a robust platform like DRATA certain aspects of the problem statement above can be adequately resolved, especially when SOC2 type 1 and 2 are brought into the picture. The challenge, as the case might present itself in this situation, is to position the SOC 2 capability in resolving some of the gaps from a technical point of view. Therefore, there seems to be an opportunity of placing the SOC 2 strategically, to unravel the problem statement. Furthermore, the question is to what extent would SOC 2 facilitate the solution and help develop a technical and information architecture suitable to avert any unforeseeable occurrence of disruption in the short and long-term?
