SOC 2
What is SOC?
SOC (Service Organization Control) reports are organizational and system control reports designed to conduct independent third-party analyses to verify that a company has the appropriate mechanisms in place to ensure the security of all the information it manages and hosts in the cloud.
System and Organization Controls (SOC) are reports prepared by an independent auditor after evaluating how a company handles its clients' data, especially sensitive data, in its day-to-day operations.
The SOC 2 certification is issued in accordance with the International Standard on Assurance Engagements (ISAE).
Having this report benefits the company by enhancing its market reputation and building trust with clients and suppliers.
What Does SOC 2 Compliance Entail?
SOC 2 controls originated from the American Institute of Certified Public Accountants (AICPA) and were included within the Trust Services Criteria (TSC) of the AICPA, which facilitate the auditing and reporting of controls used by a service organization to protect information.
SOC 2 reports assess security, availability, processing integrity, confidentiality, and data privacy. Additionally, SOC 2 reports ensure that the controls used by the service organization meet some or all five of these criteria.
Risk management must also include third parties. SOC 2 provides a framework to verify whether a service organization has achieved and can maintain strong information security while mitigating security incidents. SOC 2 is used to audit the security strategies of external providers to ensure they meet the level of protection your organization expects.
SOC Audit
The SOC 2 audit covers five aspects of data management that, when properly implemented, result in a coherent and robust cybersecurity strategy. The Trust Services Criteria (TSC) Working Group of the AICPA oversees the technical accuracy of the TSC, while the AICPA Assurance Services Executive Committee defines the five SOC 2 Trust Services Criteria as follows:
Security – Protection of data and systems against unauthorized access and data breaches. Security also includes safeguarding against system damage that could compromise data availability, integrity, and confidentiality.
Availability – Reliability of systems required for the entity to maintain normal operations.
Processing Integrity – System processing must be complete, valid, accurate, timely, and authorized.
Confidentiality – Data classified as "confidential" must be protected to meet the entity’s objectives.
Privacy – Information must be collected, used, retained, disclosed, and disposed of in a manner that complies with the entity’s data privacy objectives.
SOC 2 Requirements: The 17 Internal Control Principles
The 17 internal control principles are mandatory and must be fully implemented by any organization seeking SOC 2 certification. Additionally, there are 4 supplementary factors that may also be evaluated.
These principles ensure that the company has procedures in place to:
Maintain information security.
Ensure only relevant employees have access to sensitive data.
Minimize risks through ongoing training, system monitoring, and consistent evaluation of external partners and suppliers.
This means that a company that meets these control principles:
Trains all employees in information security.
Ensures all service providers have similar information security protocols.
Guarantees that all client data is secure, backed up, and that physical and digital access is restricted. It also ensures data is deleted at the end of the client relationship.
Has procedures in place to respond quickly to incidents.
Regularly audits information security procedures, both internally and with an external auditor.
THIS WEBSITE DOES NOT USE COOKIES OR ANY MEANS OF VISITOR CONTROL.
INTERCER NORTH AMERICA
880 Third Avenue, 5th Floor, New York, NY 10022
Office Hours: Monday through Friday. 9:00 am to 18:00 pm Eastern Standard Time (EST)
SOC 1
Focuses on the examination of controls related to financial reporting processes. It is prepared based on the ISAE 3402 standard or SSAE 18.
SOC 2
Aimed at the examination of controls related to the handling of sensitive information, based on the criteria of security, availability, integrity, confidentiality, and privacy. It is prepared based on the ISAE 3000 standard.
SOC 3
Simplified, less detailed, and general-purpose reports based on SOC 2, which can be used by service organizations as a marketing tool.