SOC Guidelines

The News Corp Systems Security Management Policy (dated Sept. 1, 2017) , The Dow Jones Third Party Security Policy (dated Sept. 1, 2017) and Vendor Information Risk Management Program (the “Policy”) provides direction and establishes requirements for implementing effective security practices when provisioning information systems.

These Guidelines are intended to provide guidance and details to implement and supplement the Policy at Dow Jones to ensure that cybersecurity risk management is  managed during the implementation and administration of SaaS systems.

SOC 1 and SOC 2 reports shall be obtained and assessed as part of the procurement process for a new SaaS system

Annual SOC reviews shall be conducted by App Owner and reviewed by Infosec for Key SaaS applications listed in Table 1 below via ProcessUnity application.

Table 1:

SOC Review MVP Checklist

1. Review list of Priority SaaS Apps to ensure list is up to date and current

2. Initiate SOC review via InfoSec’s ProcessUnity application.

3. Review and store the latest SOC (1 and 2) reports from the vendor.

4. Identify and report any potential issues to App Owner.