We have managed to collate information  with regards to SOC2 compliance which would be helpful for organisations assessing their SOC2 security posture. This preliminary information should help you get general understanding of SOC2 compliance and give you a broad sense of understanding in terms of what might be required for an organisation wanting to be SOC2 compliant/certified. 

 

SOC 2, aka Service Organization Control Type 2, is a cybersecurity compliance framework developed by the American Institute of Certified Public Accountants (AICPA). The primary purpose of SOC 2 is to ensure that third-party service providers store and process client data in a secure manner.

How is SOC2 compliance helpful to organisations?

AICPA’s cybersecurity risk management reporting framework helps organisations communicate about and CPAs report on cybersecurity risk management programs. AICPA's Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (control criteria) guideline is intended for use by CPA's to provide advisory or attestation services to evaluate the controls within an entity’s cyber risk management program. Management teams can also use the trust services criteria to evaluate the suitability of design and operating effectiveness of controls.

There are 5 criteria to choose from when doing a SOC 2, security, confidentiality, availability, processing integrity, and privacy. You can do a base report on security criteria, but the other ones can be relevant for business development or required contractually.

There are ultimately 4 types of SOC reports, a SOC1 and SOC2, each of which have a type I and type II report. A SOC1 is used when you are a service organization (i.e. payroll provider etc.) that manages an IT or service function that rolls up to a financially significant account on a client's balance sheet. A SOC2 is relevant if you manage or have access to certain types of data that carry some contractual or legal liability (i.e. health care or financial data etc.). There is a Type I and Type II version of both the SOC1 and SOC2 report. A Type I basically states that we have all of the controls in place to meet the relevant criteria of a SOC1 or SOC2 as of this date. A Type II states that we had these controls in place, and they operated effectively over this period of time (usually 6mos, 9mos, or 12mos).

A SOC1 generally has more business controls involved, and can pull in things like account reconciliations for auditor review. A SOC2 is generally more concerned with the scope of the environment where sensitive data is stored, and access to modify those environments.

It can be difficult for a small company due to the lack of some formal processes. However, it's doable, and has become a cost of doing business in some industries. If you deal with any sensitive data on behalf of your clients, then there are a lot of companies that require it. Generally, you will need to have the following covered:

Be cautious of claims made by the various software vendors  that market themselves as being able to get you through an audit at a lower total cost of ownership. They can make the audit process easier, which might even offset some of your internal effort, but the software solutions out there now don't really bring down the level of effort from the audit