IT ARCHITECTS

What is SOC 2 Compliance ?

SOC 2 is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data. The standard is based on the following Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy.

SOC 2 stands for Service Organization Control 2 and is a security framework that defines how companies should manage, process, and store customer data based on the Trust Services Categories (TSC). There are five categories to adhere to, which we will delve deeper into later in the guide:

1-Security
2-Availability
3-Processing integrity
4-Confidentiality
5-Privacy

SOC 2 compliance is unique to each company because it is a set of trust service categories as opposed to a prescriptive list of controls to mark off. Every company’s security practices will look different, meaning they can achieve SOC 2 compliance with custom policies and processes to be put into place that are relevant to your business’s operations.

Why SOC 2 Instead of 1 or 3?

As you might have guessed, SOC 2 isn’t the only SOC around. The American Institute of Certified Public Accounts, or AICPA, developed two other types of SOC reports.

SOC 1 is focused on meeting financial standards, and SOC 3 is a high-level, public-facing report with no confidential information. If you’re asked for a SOC report concerning security and data, it’s safe to assume what they’re looking for is SOC 2.

Why SOC 2 Compliance Matters

With risks rising and awareness about data security at an all-time high, it’s no longer enough to say you have good security practices in place. A growing number of companies across a variety of industries are requiring that vendors prove it with a SOC 2 report.

This means getting your policies and controls in order and tracking your compliance religiously over time. This applies to any service provider that stores, processes, or transmits customer or client data in the cloud—which is just about all of us, these days.

If you haven’t had a prospective customer ask for a SOC 2 report yet, you might think you don’t need one. For startups especially, it can be tempting to delay starting the compliance process in lieu of other priorities. But it’s really only a matter of time—we’re hearing from new customers everyday that they’ve started the process because their sales cycle stalled without one.

It’s not exactly a quick process to become SOC 2 compliant either. It can take companies months to become SOC 2 compliant, meaning money left on the table for your company. Not to mention, most SOC 2 report requests are for SOC 2 Type 2, meaning you’re being asked to prove you have stayed compliant over a long period of time (more on this in a minute).

Since compliance itself is a process and you’ll need to prove that compliance over time, experts recommend making it a priority now—before you’re asked to provide a report. The longer you take to become compliant, the further you can fall behind to the competition.

Steps to Achieving Compliance

Understanding the five Trust Services Categories is essential in shaping your company’s security practices. We go in depth to all five below but only security is required for SOC 2. However, many companies will opt to include other categories in their scope depending on their industry and the types of data they process.

No matter which criteria you’re evaluating, auditors will look at how effectively your controls are operating, how quickly you respond to risks or incidents, and how clearly you communicate about risks, changes, and priorities within your organization.

1-Security

According to the AICPA standards, security means:

“Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to achieve its objectives.”

This means following best practices like:

1-Two-factor authentication
2-Access controls
3-Identity management
4-Encryption
5-Breach alerts
6-Maintaining firewalls

It also means having well-documented security policies and procedures, a good security training program, and enforcing best practices with your infrastructure provider and vendors, among other things.

2-Availability

Systems meet availability standards as outlined in a Service Level Agreement (SLA).

There is no set performance level required in the SOC 2 standard. When auditors evaluate availability, they’re looking at if you keep your promises in the SLA. For example, if you guarantee 99.95% availability, are you hitting that metric? They also review the systems you have in place to ensure performance, support disaster recovery, and incident management.

3-Processing Integrity

As the AICPA standards explain, processing integrity is when “system processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.”

In simple terms, this means the systems process as expected or promised. Auditors look for good monitoring and quality assurance practices, as well as error reports and how quickly system issues are addressed.

4-Confidentiality

Data is safe from unauthorized access.

Meeting confidentiality standards typically means having encryption, access controls, and firewalls in place to protect customer data. It may also mean robust user permissions that ensure data is only accessible to those in the organization who truly need it.

In some cases, confidentiality or privacy laws like the EU’s General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA) come into play here and the auditor will be looking at compliance from a legal standpoint as well as an industry standard one.

While privacy standards apply specifically to customer data, confidentiality may also include protecting clients’ intellectual property, trade secrets, and other applicable information.

5-Privacy

Personally identifiable information (PII) is private and users have full control over its use.

This piece of the compliance puzzle is particularly important in light of ever-growing privacy regulations like GDPR and CCPA.

In this category, auditors are specifically looking for how well you communicate with customers about their data. Customers should always know:

How their data is used
How they can access and update their data
Their options are for opting out
Options for limiting data use
How they can delete their data, and more.

You’ll also need to have practices in place to communicate with customers if there is a data breach or incident along the way.

Standards also ask auditors to look at best practices around data access, retention, and deletion. Auditors review that you monitor your privacy compliance on an ongoing basis as well as keep track of privacy-related complaints, disputes, and incidents.

SOC 2 Attestation Reports

When a prospective customer asks for a SOC 2 report, what they’re asking for is a third-party attestation. These reports must be generated by licensed CPA firms and their goal will be to assess one or more of the Trust Services Categories we described above. There are two types of SOC 2 reports, Type 1 and Type 2.

SOC 2 Type 1

SOC 2 Type 1 reports focus on a specific point in time and reviewing if you were compliant (were you compliant last week?). It does not review compliance over a long period of time. This type of SOC 2 report is requested less than SOC 2 Type 2.

SOC 2 Type 2

SOC 2 Type 2 is the more commonly requested report because it holds more weight by reviewing a company’s compliance over a period of time (were you compliant for the last continuous year?). SOC 2 Type 2 holds companies to a higher bar because their security practice will need to be more robust and provide continuous compliance.

Typically, either report will contain five sections:

An opinion letter/auditor report
Management assertion
Detailed description of the system or service being evaluated
Details specific to each of the Trust Services Categories being evaluated
Test results from testing done on the controls evaluated

When hiring a CPA to handle your SOC 2 audit, be prepared to provide security questionnaires, documentation of your policies, practices, and security controls, and evidence that those policies, practices, and security controls are being consistently followed within the organization.

SOC 2 Compliance Risks and Best Practices

Meeting SOC 2 standards is a time-consuming challenge—and if you don’t have the right tools in place to monitor, alert, and automate, it can be hard to keep up with.

For companies that do stay compliant, the secret sauce starts with these best practices:

Prioritization
If compliance is a priority (and with more and more companies requiring it, it should be), that priority needs to be built into your teams’ schedules, priority lists, and budgets from the top down. If it’s an afterthought, it won’t get done.

Consistent, Gap-free Monitoring (Continuous Compliance)
When it’s time for your audit, you typically have to prove compliance for the last year. This means 24-7 monitoring is essential and you’ll need proof of that monitoring to share with your auditor.

Security Incident Alerts
Keeping systems secure (and therefore compliant) means catching and resolving security threats fast. To do this, you’ll need to set up system alerts for things like unauthorized file transfers, account logins, or access or modification of data, controls, or configurations.

Detailed Reports of Incidents
Incidents happen to the best of us. What matters for compliance is transparency: what happened, how it was resolved and how quickly, what systems were impacted and how major was the incident? Make sure you have detailed records and evidence that shows how you handle incidents when they happen.

Read More About GDPR

Buy From Amazon