Up next in our Ask the Expert series, Ben Rothke, Senior Information Security Manager, reviews two certifications that should be part of your information security strategy: Service Organization Control (SOC) 2 Type 2 and International Organization for Standardization (ISO) 27001. Tapad, a part of Experian, is 27001 and SOC 2 Type 2 compliant.
Two information security certifications you can trust
Seals from Good Housekeeping and Underwriters Laboratories give consumers confidence that they can trust the product that they’re buying. For IT solutions or service providers, what, or who can you turn to for that seal of approval? There are many equivalent third-party attestations you can use. But which should you trust?
- The International Organization for Standardization (ISO) 27001
- The American Institute of Certified Public Accountants (AICPA) System and Organization Controls (SOC)
International Organization for Standardization (ISO)
27001 is an international standard for information security from the ISO. ISO 27001 is globally acknowledged and sets requirements for controls, maintenance, and certification of an information security management system (ISMS). This international standard provides organizations with a framework to identify, manage and reduce risks related to the security of information
System and Organization Controls (SOC)
The SOC, as defined by the AICPA, is a set of audit reports. SOC reports, like 27001 certificates, are used by service organizations to give their customers the confidence they have adequate information security controls in place to protect the data that they handle.
SOC 2 is an assessment of controls at a service organization regarding security, availability, processing integrity, confidentiality, and privacy. The purpose of the report is to provide extensive information and assurance to a broad range of users about the controls at a service organization that are relevant to the security, availability, and processing integrity of the systems that process user data, as well as the confidentiality and privacy of the information processed by these systems.
Why ISO 27001 and SOC 2 are important
The value of these third-party attestations is two-fold:
- Organizations can show they have passed an independent external audit
- Third-party attestations save organizations the time of having to do their own audits
In addition to 27001 and SOC 2 Type 2 compliance, we are also certified with ISO 27017 and 27018, which are add-ons to 27001 that are specific to cloud computing. We take the security and privacy of our customers’ data as seriously as they do.
Every cloud service provider (CSP) has a responsibility matrix that details what security and privacy tasks they are responsible for and which ones the customer is responsible for. Any cloud customer that needs to be made aware of what their security tasks are is putting themselves at risk.
So, when you want to engage a CSP, ask them for their attestations. They worked hard for them and will be proud to share their compliance.
We’re powered by decades of setting standards in marketing services
At Experian, we’re a privacy-first business. We’re highly focused on respecting people, their data, and their privacy. We continue to show our dedication to information security by completing these security audits every year.
The constant changes to data compliance regulations can be challenging to navigate, but you don’t have to do it alone. Contact us today. We will be your guide so you can ethically and confidently reach your customers.
Contact us today
About our expert
Ben Rothke, Senior Information Security Manager
Ben Rothke, CISSP, CISA, is a Senior Information Security Manager at Tapad, a part of Experian. He has over 25 years of industry experience in information systems security and privacy. His areas of expertise are in risk management and mitigation, security and privacy regulatory issues, cryptography, and security policy development. Ben is the author of Computer Security – 20 Things Every Employee Should Know (McGraw-Hill), and writes security and privacy book reviews for the RSA Conference Blog and Security Management magazine.
Latest posts
Every year, the Experian team attends the Consumer Electronics Show (CES) in Las Vegas, to immerse ourselves in the world's most significant consumer tech showcase and stay at the forefront of the latest technological advancements and innovations that shape the AdTech industry. This year's event was a vibrant melting pot of innovation and vision, from streamers taking a bigger bite of the advertising pie to the emergence of AI-powered solutions and drone delivery services. Amidst these advancements, the dynamic interplay of technology, media, and advertising raised important questions, especially in the context of evolving regulations and cookie deprecation. During CES, we captured insights from various thought leaders, and in the coming months, we'll be sharing these valuable perspectives with you. Watch the video below for full insights coming from our content studio onsite during the event. Or, keep reading for a recap on four key trends from CES and what they mean for your business in 2024! “My first CES was a major success. You could feel the buzz in the air as new ideas and partnerships were being created within and across industries. The intersection of the different players within retail media, connected TV, retail technology, the demand and supply-side, and agencies all in an ever-changing world of regulation and privacy begs for a solution that can maximize a successful outcome for all.”anne passon, sr director, sales, retail & cpg 1. Audience targeting: How first- and third-party data work together A central theme at CES was the importance of audience targeting, highlighting the crucial role of first-party data. However, it’s clear that to maximize its potential, this data needs to be augmented with sophisticated identity solutions and enriched with third-party insights, all while navigating the complexities of privacy regulations. This integrated approach is vital to understanding audiences and for creating more effective marketing strategies that comply with privacy regulations. 2. Standardizing metrics in retail media networks The challenges around retail media networks, particularly in terms of standardizing metrics like incremental return on ad spend (iROAS), were a hot topic at CES. This complexity around this topic underscores the need for neutral, expert third parties to help bring clarity and consensus, aiding businesses in navigating this multifaceted domain. 3. The challenge of switching data solutions Discussions covered the broader challenges associated with transitioning to new data solutions. For businesses, this involves a critical assessment of the benefits versus the costs and complexities of adopting new platforms or systems. This decision-making process is increasingly significant as data strategies become integral to marketing success. 4. Identity solutions in a cookieless future With the industry moving toward a cookieless future, the spotlight at CES was on the importance of robust identity solutions. Understanding the functionality and necessity of various universal IDs is essential to minimize data loss and maintain effective targeting. Investing in flexible and adaptable identity solutions like the Experian Graph is essential to maintain effective targeting and audience engagement in this new landscape. Announcements and advertising innovations at CES 2024 CES was a stage for significant announcements and innovative marketing initiatives: Criteo and Albertsons announced their collaboration in retail media. Instacart's partnership with Google for enhanced shopping ads and AI shopping carts. NBCUniversal's advancements in streamlining programmatic advertising. Brands like Netflix, LG, Freewheel, and Amazon Ads also captured attention with their creative marketing strategies, ranging from unique collaborations to themed promotions and captivating events. These insights from CES provide a glimpse into the future of technology, media, and advertising. They highlight the need for adaptability, innovation, and informed decision-making in these dynamic industries, especially in the context of privacy regulations. Stay tuned for our series of posts where we'll dive deeper into these topics, sharing exclusive insights from industry thought leaders. Follow us on LinkedIn or sign up for our email newsletter for more informative content on the latest industry insights and data-driven marketing. Contact us Latest posts
Short-form video content is becoming more prevalent on video-sharing platforms. Keep up with trends and marketing strategies to stay relevant.
Since joining the Truthset Data Collective in 2023, Experian has consistently demonstrated leadership in data accuracy. The latest Q2 2025 analysis reaffirms this commitment.