Service Organization Control (SOC) 2®

What is SOC 2® Compliance?

SOC 2® is a collection of reports that an external CPA uses to validate the security, availability, processing integrity, confidentiality, and privacy controls of confidential business data that your organization has established.

External auditors assess and grant SOC 2 attestation based on the following five Trust Service Criteria:

1. Security: Your data and systems should have protection against unauthorized access or information disclosure, damage, and leaks.

Pro tip: If applicable, discuss in your SOC 2® report how your firewall and multi-factor authentication systems prevent unauthorized users from accessing sensitive data.

2. Availability: All your information and data systems must always be available to meet your business objectives. 

Pro tip: If applicable, show in your SOC 2® report how performance monitoring systems, geo-redundant data servers, and incident response plan will ensure data availability. 

3. Processing integrity: All sensitive business data records must be stored accurately and completely. Only authorized users must be able to access sensitive business data.

Pro tip: If applicable, highlight your data quality policies in your SOC 2® report to show how your organization prevents incomplete and unauthorized data submissions.

4. Confidentiality: All confidential and sensitive business information must remain protected as you say it is.

Pro tip: If applicable, show in your SOC 2® report how your organization uses encryption, user-specific access controls, and firewalls to prevent bad actors.

5. Privacy: All personal information about your users must be collected, used, retained, disclosed, and destroyed as per your company’s privacy policies.

Pro tip: If applicable, your SOC 2® report can show how your organization adheres to other applicable privacy requirements such as the Privacy Management Framework, GDPR, or CCPA.

Note: Your organization only needs to include the SOC 2 Trust Service Categories that apply to your processes. You need not adhere to all five SOC 2 Trust Service Categories. For example, if your company only stores customer information and doesn’t handle any information processing, you don’t need to audit for the Processing Integrity trust principle.

What is SOC 2®?

A SOC 2® report is an important asset for organizations, and it’s becoming more of a mandate than a nice-to-have. But SOC 2® reporting can be time-consuming and expensive, especially if your organization doesn’t have compliance expertise or modern tools to handle the work. Here’s the good news: there is a way to gain control over your SOC 2® compliance program and dramatically reduce your workload. 

Developed by the American Institute of CPAs (AICPA), SOC 2® reporting provides insight into internal controls that exist within an organization to address risks related to security, availability, processing integrity, confidentiality and/or privacy. A CPA independently validates the report and uses specific criteria, methodology and expectations that enable consistency in comparison across organizations.  Before a SOC 2® report is issued, an independent CPA conducts an assessment of the scope, design, and (for Type 2 reports) the effectiveness of internal control processes. Your organization and your SOC 2® assessor determine the scope of a SOC 2® report.

What are the benefits of SOC 2®compliance?

SOC 2® is a must-have for any organization that manages customer data, or integrates with business partners. If you’re selling software or services, your customers will want to see your SOC 2®report to have confidence that their data will be protected, and that you won’t introduce vulnerabilities into their systems. If your customers or business partners are in highly regulated fields or are publicly traded companies, a SOC 2®report is imperative to be considered as a viable vendor.

A SOC 2® report can also help reduce audit fatigue by eliminating or reducing the need for audits from customers and business partners. As part of their risk management practices, many companies annually audit their customers and business partners. This can result in being bombarded with a high volume of time-consuming audits coming from multiple sources. A SOC 2® report is a great solution for this, as companies will often accept a SOC 2® report in place of conducting a separate audit.

What should be the scope of a SOC 2® audit?

A SOC 2® audit must include all data systems and processes that collect sensitive business information. However, it does not need to include an exhaustive list of all data processes.

Determining the scope of your SOC 2® audit is critical to its success. If you include too much in the scope of your audit, you’ll waste unnecessary time on processes and procedures you don’t have or need. If your scope is too narrow, you won’t be evaluating the things that matter to your current and prospective customers, risking the chance of spending more on remediation measures and future audits.

A typical SOC 2® audit will include the following components:

• An opinion letter
• Management assertion
• A detailed description of the system or service
• Details of the selected trust services categories
• Tests of controls and the results of testing
• Optional additional information

Will my SOC 2® audit cover all five Trust Service Categories?

All the five trust service categories won’t apply to every company. So your audit only needs to include the categories that are relevant to your business operations.

For instance, you won’t need to include the ‘Processing Integrity’ category in your audit if your business only stores user information without processing it. Similarly, if your business doesn’t store any sensitive or confidential information, then don’t need to audit for the Confidentiality category.

The scope of your audit should be informed by what is most relevant to your customer base and their primary concerns.

Which SOC 2 Trust Service categories should the audit cover?

In general, categories that are essential for delivering your core service or product offering should be subject to more rigorous controls than systems that aren’t essential. 

For example, systems that process reimbursement receipts can be safely excluded. You may also further limit the scope of your SOC 2 report by distinguishing between production and non-production systems.

Once you’ve determined the scope of your SOC 2 audit, you can work on developing the processes and procedures you need to pass an audit successfully. Nailing down the scope helps you avoid spending resources on unnecessary compliance measures.

Further Reading: SOC 2 Compliance: What You Need to Know and Need to Do

What industries need SOC 2® Certification?

Healthcare, retail, financial services, SaaS, cloud storage, and cloud computing businesses will likely benefit from achieving SOC 2® certification.

If your business handles any kind of customer data, getting a SOC 2® report will help show your customers and users that you are committed to protecting their data.

Because it’s so widely adopted and acknowledged, many procurement and security departments require a SOC 2® report before they approve the purchase of your software or service. So getting a SOC 2® attestation is a necessity in most industries.

Note: SOC 2 isn’t legally required, and getting certified isn’t technically mandatory. However, B2B and SaaS businesses should seriously consider becoming certified (if they aren’t already) because it’s often a requirement in vendor contracts.

How to prepare for your SOC 2® audit?

The following 7-step SOC 2® compliance checklist will guide your organization through a successful SOC 2® audit.

1. Conduct a comprehensive risk assessment to identify potential security and privacy risks to your systems and data. Prioritize these risks based on severity and develop a remediation plan. 

At the very least, include physical risks (missing security locks on data center doors), human risks (poor cybersecurity training), regulatory risks (your incident response plan doesn’t meet expectations), and business continuity risks (you don’t have a list of alternative service providers).

2. Establish written policies and procedures that address each identified risk. Also, ensure that all policies and processes are aligned with the goals of at least one of the SOC 2® Trust Services Categories that you’ve included in your audit. 

Demonstrate how you communicate and enforce these policies among all relevant personnel. For instance, you should highlight the integration of cybersecurity training into the onboarding process for every new employee.

3. Implement user access controls, such as strong passwords, multi-factor authentication, and password reset policies. Highlight all software and IT controls that restrict unauthorized access to sensitive business data.

In addition to preventing unauthorized users, ideally, your access controls must also restrict even your employees from accessing sensitive business information from a personal account or device. If possible, also show how each user can only access the information they need. For example, a regional manager won’t be able to access the personal information of a user who isn’t from the same region.

4. Set up monitoring and logging mechanisms to track system activities. Regularly review and analyze logs to detect any unusual behavior. 

Detailed logs from various sources, such as security software, servers, firewalls, and networking equipment, can offer clues to investigating a security incident. You can organize this information to draft a quick and effective incident response plan.

5. Draft an incident response plan that outlines the steps to be taken during a security incident. Assign tasks to specific roles, provide up-to-date contact information, and train employees on their roles.

Additionally, your incident response plan should include up-to-date contact information for all key employees. An effective plan must also train everyone on their roles, so they know what to do in a crisis.

6. Manage vendor risk by assessing the security controls of your vendors, mitigating identified risks, and monitoring them regularly. Consider requesting a SOC 2 audit from your vendors.

7. Perform a pre-audit readiness assessment to review the work done and identify any remaining gaps. Consider hiring an external auditor for an objective assessment.

Just like making changes in the design phase is far more cost-effective than changing an actual building, it is far better (read: cheaper) to spend more time on remediation before the formal SOC 2 audit after the external auditor finds shortcomings.

Further Reading: SOC 2 Audit Checklist: Key Steps to Get You From Start to Finish

SOC Type 1 vs. Type 2

There are two types of SOC 2® reports – a Type 1 and a Type 2.