SOC 2® Compliance: What You Need to Know and Need to Do

Businesses today are storing increasing amounts of data on customers, and it’s not just users who are concerned about the safety of their data.

One of the compliance standards that has emerged in an effort to ensure data protection is Service Organization Control 2, or SOC 2® reports. While SOC 2® standards aren’t part of a law or regulation, they are equally important to your business if you handle customer data. So what is SOC 2®, and do you need to worry about getting your business SOC 2® certified?

In this article, we will cover the basics of SOC 2®, who should pursue SOC 2® certification, how to pass a SOC 2® audit, how to choose an auditing partner, and how to incorporate SOC 2® standards into your business practices continuously. Related: Guide to SOC 2®

What is SOC 2®?

SOC 2® is an auditing procedure developed by the American Institute of CPAs (AICPA) that ensures your business or application is handling customer data securely and in a manner that protects your organization and the privacy of your customers.

Businesses that handle customer data proactively perform SOC 2® audits to ensure they meet all of the criteria. Once an outside auditor performs an SOC 2® audit, if the business passes, the auditor will issue an SOC 2® certificate showing that the business complies with all of the requirements. 

A SOC 2® audit covers five Trust Service Categories:

• Security: This measures how well your data and systems are protected against unauthorized access or information disclosure and damage to the systems that protect the availability, integrity, confidentiality, and privacy of the information you store.
• Availability: This trust category covers whether your information and systems are available for operation and use for purposes of meeting your company’s objectives.
• Processing integrity: This principle assesses whether your system’s processing is complete and accurate and only processing authorized information.
• Confidentiality: This covers whether information that’s designated as confidential is protected as you say it is.
• Privacy: This final trust principle looks at whether your users’ personal information is collected, used, retained, disclosed, and destroyed in accordance with your company’s privacy notice and the Generally Accepted Privacy Principles (GAPP).

There are two types of SOC 2® audits: Type 1 and Type 2. The difference between them is pretty simple: A Type 1 audit looks at the design of a specific security process or procedure and one point in time, while a Type 2 audit assesses how successful that security process is over time.

A SOC 2® audit will include:

• An opinion letter
• Management assertion
• A detailed description of the system or service
• Details of the selected trust services categories
• Tests of controls and the results of testing
• Optional additional information

Who must comply with SOC 2®?

As we mentioned earlier, SOC 2® isn’t legally required, and getting certified isn’t technically mandatory. However, B2B and SaaS businesses should seriously consider becoming certified if they aren’t already because it’s often a requirement in vendor contracts.

Because it’s so widely adopted and acknowledged, many procurement and security departments may require a SOC 2® report before they approve the purchase of your software.  

If your business handles any kind of customer data, getting a SOC 2® report will help show your customers and users that you take data security and protection seriously. Healthcare, retail, financial services, SaaS, and cloud storage and computing companies are just some of the businesses that will benefit from SOC 2® compliance certification.

How does SOC 2® fit into your compliance program?

Because it’s a voluntary compliance framework and not imposed on businesses by any federal or state regulations, you might think that most businesses treat it as an afterthought or only bother to gain the certification when they encounter a potential client who requires it.

In reality, SOC 2® is often the first compliance framework that B2B startups pursue compliance with because of the benefits it provides: it gives you the opportunity to see where there are large gaps in your internal controls and whether the processes you’ve put into place actually work.

It tells you if the security measures you’ve put in place are effective and if your employees are performing the controls they’re responsible for. Because it covers so many different aspects of the security and privacy, SOC 2® is a great foundation for a compliance program.

What should be the scope of a SOC 2® audit?

Determining the scope of your SOC 2® audit is critical to its success. If you include too much in the scope of your audit, you’ll waste unnecessary time on processes and procedures you don’t have or need, and if your scope is too narrow you won’t be evaluating the things that matter to your current and prospective customers, risking the chance of spending more on remediation measures and future audits.

Will a SOC 2® audit cover all Trust Service Categories?

Every audit doesn’t have to include all five of the trust service categories because those categories won’t apply to every company. For example, if your company only stores customer information and doesn’t handle involve any information processing, you don’t need to audit for the Processing Integrity trust principle; likewise, if you don’t store any data that is considered confidential, you don’t need to audit for the Confidentiality principle. The scope of your audit should be informed by what is most relevant to your customer base and their primary concerns. 

Which systems will a SOC 2® audit cover?

In general, systems that are essential for delivering your core service or product offering should be subject to more rigorous controls than systems that aren’t essential to delivering your core service. For example, systems that process lunch orders or host social media accounts can be excluded. You may further limit the scope of your SOC 2® report by making a distinction between production and non-production systems. For example, while production systems should have stricter information security controls or confidentiality categories, tools that support internal teams do not necessarily require the same strict level of controls. 

For more information on how to speed up a SOC 2® report, check out this article from Strongdm. 

Once you’ve determined the scope of your SOC 2® audit, you can work on developing the processes and procedures you need to pass an audit successfully. This is another reason that this scope is so important to nail down: if you don’t carefully consider which SOC 2® Trust Service Categories you need to be compliant with, you’ll either get an incomplete picture of what you need to do to fully protect your information, or you’ll spend time on building unnecessary compliance or data protection measures.

SOC 2® Type 1 vs. Type 2 

There are two types of SOC 2® reports – a Type 1 and a Type 2. 

A SOC 2®Type 1 examination evaluates controls at a point in time. This means that the design of the controls are assessed, and implementation is confirmed, but consistent performance is not evaluated in a Type 1 report. 

A SOC 2® Type 2 examination covers the operating effectiveness of controls over a specific time period, such as a six—to 12-month period. A SOC 2® Type 2 report is a higher bar than a Type 1 because, in addition to evaluating the design and implementation of control processes, it also assesses that the controls were consistently performed throughout the period. This provides a greater level of confidence to customers and business partners as to the effectiveness of control processes.

When to start the SOC 2® compliance journey

If you know you’ll be selling technology services/software to enterprises and storing and/or accessing sensitive customer data, it’s a good idea to work on becoming compliant early in your company’s journey. 

Our company’s founder and CEO — Craig Unger — believes that a good time to kick the process into gear is when your team has already developed the majority of features for your core service and you’re close to shipping production-ready software. When you start the SOC 2® compliance journey, you want to make sure you have already established some key processes. You need to have sufficient IT security processes and documentation of those processes for an auditor to react to, so they can provide insights on the gaps.  

Starting early gives you the opportunity to embed security controls into your product as it’s being developed, which is a far easier endeavor than completely re-architecting the system later to meet certain security standards. When you start early, you are able to integrate processes and controls into your team’s culture from the beginning. This can be a source of competitive advantage that industry incumbents cannot replicate.

How to choose an auditor 

The most important thing to understand when choosing a SOC 2® auditor to work with is that only CPA firms can perform a SOC 2® audit. CPA firms might employ non-CPAs with expertise in areas such as data security to assist with these audits, but the final audit has to be provided and issued by a CPA.

After you’ve gotten your SOC 2® report, you may also want to be certified in other frameworks (e.g. ISO 27001 or HIPAA). You might consider choosing a firm that specializes in several of the compliance frameworks that you’re pursuing compliance with or that has experience working with the industry you’re in. When you engage a firm that has experience in all of the frameworks you’re working towards, you can complete your audits faster and at a lower cost.

Preparing for an audit

Once you’ve decided on the scope of your SOC 2® audit and selected an auditing firm, there are a few other things you can do in advance of your audit to get ready.

Gather documentation 

First, gather all of the compliance documentation that you have in one place. Depending on which of the five Trust Service Categories you’re auditing for, you’ll need to present different types of documentation and compliance evidence. If you have compliance management software, that will be a huge help here. A software platform like Hyperproof allows you to store, tag, and call up documentation quickly and alerts you when documentation needs to be updated.

Complete audit readiness assessment 

Once all of you’ve collected all your documentation, you should work with your auditor to complete an audit readiness assessment, which can help you prepare for an audit months before it happens. with the help of your auditor. It can be beneficial to be important to take advantage of this pre-audit opportunity because it lowers the chances that your auditor will find big gaps in your security or compliance programs that force them to fail you. 

An audit readiness assessment also gives you a tool to rally your organization and educate stakeholders about the importance of establishing data compliance and IT security measures. When you have to “get your house in order” in time for an auditor’s visit, it can impress upon your stakeholders, such as executives and engineering managers, a sense of urgency to jump start your compliance program.

Meet with your auditor 

Finally, meeting with your auditor prior to the actual audit is beneficial because your auditor can answer questions, address concerns, and give you an idea of whether a specific control you’ve implemented is up to snuff. 

Preparing for an audit is time well spent. It smooths the audit process and decreases the chances of a repeat due to a failed audit.

What to expect during the security audit 

An independent Certified Public Accountant (CPA) should conduct a SOC 2® audit. For each applicable Trust Services Category, the auditor will evaluate the efficacy of your controls by reviewing the evidence you submit. 

During the assessment, your auditor will ask you to submit all types of documents electronically, such as organizational charts, asset inventories, onboarding and offboarding processes, and change management processes. Your auditor may also interview key stakeholders within your organization (e.g., security engineers, and IT staff) to better understand your internal processes and operating procedures. 

The audit itself can take anywhere between a few days to a couple of weeks to complete, but thorough preparation may require several months.

How to comply with SOC 2® on a continual basis

Most SOC 2® reports cover a 12-month period, but some companies choose to complete these audits every six months. After the initial effort to become SOC 2® compliant is over, ideally you will only have to complete maintenance activities and not have to build any systems or processes from scratch.

Like almost any other compliance framework, maintaining SOC 2® compliance is easiest when automating. The more manual processes, the more chances there are for missed compliance activities, out-of-date evidence, and procrastinated responsibilities.

Compliance management software that tracks your program is invaluable here. A good one will not only help you prepare for an audit, but also ensure that you are alerted when some part of your process is falling out of compliance, whether it’s due to a change in regulations or someone not completing a procedure.

How security compliance operations software can help 

If you’re new to the SOC 2® process, Hyperproof can make the entire process easier, smoother and faster. Hyperproof is security compliance operations software that helps organizations implement, maintain and scale up multiple security and privacy programs. You can use Hyperproof to set up your SOC 2® compliance program; Hyperproof comes with illustrative controls mapped to the five service Trust Service Categories that you can tailor to your specific environment. 

Hyperproof also makes it much easier to map your internal controls to SOC 2® requirements, collect evidence (or documents for audits), review evidence and collaborate remotely with staff and external advisors to get everything in order.

If you’re very early in your information security and compliance journey and need assistance figuring out how to achieve SOC 2® compliance, we can refer you to top-tier CPA firms that can guide your leaders through the process, from start to certification. 

To learn more about how Hyperproof can help you efficiently implement SOC 2® and maintain compliance, request your personalized demo.