What is SOC 2?
SOC 2 is a security framework developed by the AICPA (American Institute of Certified Public Accountants) with five areas called the Trust Services Criteria that demonstrates how a service organization protects customer information.
These five areas include:
- Security (referred to as the “common criteria”)
- Availability
- Processing Integrity
- Confidentiality
- Privacy
A SOC 2 always contains the “common criteria” which includes organizational controls, access management, risk management, change management, communications, and system operations.
It is quite unusual for a company to attempt all five Trust Services Criteria at once. Normally, businesses will start their SOC journey with a SOC 2 Type 2 audit covering the common criteria. and Type 2 reports. (More on the differences between SOC 2 Type 1 and Type 2 below).
What does SOC 2 stand for?
SOC 2 stands for Systems and Organization Controls 2.
Who needs to be SOC 2 compliant?
Cloud service providers, SaaS providers, and organizations that store customer data in the cloud should complete a SOC 2 report.
The most common, and most compelling reason a company would be asked to demonstrate SOC 2 compliance is because their customer base has a need to ensure their vendors are securing and managing data effectively. This applies to more companies as they use cloud technology to store customer information.
Unlike regulatory frameworks like HIPAA and GDPR that are less defined and don’t have a formal audit authority to determine compliance, SOC 2 is independently verified by the AICPA and is considered to be an industry-acceptable security accreditation.
How long does a SOC 2 audit take?
A SOC 2 audit may take several months depending on the amount of controls and scope of the report. While the SOC 2 process can seem lengthy, your efforts don’t have to be complicated. With proper evidence collection and systems in place, preparing for a SOC 2 audit can be streamlined to make the process repeatable (easier to prepare for other compliance frameworks in the future).
Some companies claim to speed up this process and complete a SOC 2 in a matter of weeks vs. months.
Not so fast.
There are a couple reasons completing a SOC 2 in two weeks can be damaging to your overall compliance and security program. Rushing compliance sacrifices quality, leading to unsatisfactory audit results and wasted time for those involved. Secondly, completing a SOC 2 audit requires a human element that simply cannot be automated in a short amount of time. From documentation and evidence collection to employee training, a SOC 2 takes much longer than a couple weeks.
To understand the importance of the SOC report and why you should take special care to achieve SOC compliance, let’s go back to the beginning.
Should you automate your SOC 2 audit?
Hear from Maloney + Novotny Shareholder Dale Dresch on why automating your entire SOC 2 audit can be detrimental to your long-term security and compliance.
SOC 2 eBook Download
The Ultimate Guide to Empowering a People-First SOC 2 Strategy
The lifetime of SOC 2
Hear from 360 Advanced Practice Director John Kadechka on how the SOC 2 audit changes year after year.
Want more advice from SOC 2 experts? Tune into the on-demand SOC 2 Master Class featuring all-star auditors.
SOC 1 vs. SOC 2 vs. SOC 3
With all this talk about SOC 2, you might be wondering about the other SOC reports.
The AICPA has defined three different types of SOC reports. All three reports are important but serve separate purposes around security. In this section, we’ll decipher the difference between SOC 1, SOC 2 (and the difference between SOC 2 Type 1 and SOC 2 Type 2), and SOC 3 reports.
What is a SOC 1 vs. SOC 2?
A SOC 1 (Service Organization Control 1) report is more financially focused than SOC 2, and involves service organization controls relevant to the company’s customer financial information.
A SOC 2 helps service organizations demonstrate their cloud and data security controls. The SOC 2 includes the five areas called the Trust Services Criteria as mentioned previously in this guide.
SOC 2 Type 1 vs. SOC 2 Type 2
The AICPA has identified two types of SOC 2 attestation reports, a SOC 2 Type 1 and SOC 2 Type 2. While both are very important frameworks, they service different purposes.
What is SOC 2 Type 1?
A SOC 2 Type 1 report centers around a ‘point in time’. It focuses on the description of the systems, controls, and the ability of these controls to obtain their objectives at a certain point in time, e.g. June 23rd, 2019. SOC 2 Type 1 does not show tests of controls or reports. It simply ensures that you have controls and processes in place.
A SOC 2 Type 1 report starts with the preparation required to build all the evidence you need. This can be done internally or with the assistance of professional services experts who will guide your company through the process and what is needed. When you believe you have all the processes in place you would then engage an auditor to conduct the audit. SOC 2 Type 1 might take 2-3 months to prepare, complete the audit and then fix any issues that were raised by the auditor.
The audit will go more smoothly if you gather all the information on the controls and processes in one place and show which employee owns each process and that they have been signed off. This will save your company time with the auditor.
What is a SOC 2 Type 2?
The more insightful report is the SOC 2 Type 2. Because this is a more rigorous report it is the most commonly requested. SOC 2 Type 2 generally applies to 12 months of history. What you will demonstrate in a SOC 2 Type 2 is not only that the controls and processes are in place, (done in a SOC 2 Type 1), but that you can test these controls and procedures and show their results. This process makes a SOC 2 Type 2 a much more intense check for organizations to perform than a SOC 2 Type 1. Approximately 3 to 6 months after completion of the audit you are required to go through the SOC 2 Type 2 again because compliance requires an ongoing demonstration of security and procedures. This will continue to be an annual process to maintain your SOC 2 Type 2 certification.
What is a SOC 3?
A SOC 3 report requires a similar level of effort to the SOC 2 report because the same controls are reviewed. Organizations typically generate a SOC 2 and then pay for an extra SOC 3 report to be written by the auditor. The SOC 3 is used as a more public report, whereas the SOC 2 would have a limited distribution internally and to partners, as it might include confidential material. A SOC 2 report would require a Non-Disclosure Agreement before it was shared with a third party. Typically a SOC 3 report is not done as an independent document.
Does your organization need to demonstrate SOC 2 compliance?
To confidently understand your SOC 2 requirements, it’s important to really understand the report itself, including the two types of SOC 2 reports. First, make sure you understand the difference between SOC 1, SOC 2, and SOC 3. Once you’ve determined that you need SOC 2, you’ll want to dig in on the two types: SOC 2 Type 1 and SOC 2 Type 2. All SOC reports are controlled by the AICPA (American Institute of CPAs).
Both Type 1 and Type 2 reports are Service Organization Control reports. They are designed to help service organizations that provide services to other entities, build trust and confidence in the service performed and controls related to the services through a report by an independent CPA. Most organizations that require compliance validation eventually undergo a SOC 2 Type 2, however, it’s often recommended to start with SOC 2 Type 1.
The Benefits of a SOC 2 Report
There are various reasons why an organization should undergo a SOC 2 audit. In this section, we’ll cover some of the most common reasons companies choose to complete a SOC 2 report and why doing so is one of the most important measures you can take to demonstrate compliance and security.
1. It shows your customers that you’re compliant, and take security seriously.
Most companies choose to complete a SOC 2 audit simply because a client asks them to demonstrate their security parameters that are in place–while other companies recognize the competitive advantage of having a SOC 2 in place before a client or prospect asks. This allows them to get ahead of the game by completing the audit process before it is requested.
There are times in which internal management wants to see how their security posture is working and if upgrades are needed. In the event a client sends a very detailed security questionnaire, organizations can provide a SOC 2 to save time in completing the request. SOC 2 audit can also be a competitive differentiator and could help you win new business in a competitive situation.
2. It may be easy for you to accomplish–and makes future frameworks easier to complete.
Of course, there are other standards such as HIPAA, NIST, ISO27001, and HITRUST. If you are already doing another certification you may have many of the controls in place already making a SOC 2 easier to complete.
SOC 2 is also less prescriptive than some other frameworks. Not only is it comprised of 5 separate Trust Categories allowing organizations to select only one or two to start, but there is also greater flexibility in defining the overall scope of the engagement when drafting the management assertion. Of course, both these points could also be viewed as a negative if the intended recipient of the report subsequently concludes the scope is insufficient.
3. There are long-term cost savings involved.
A SOC 2 audit can cost an organization upwards of tens of thousands of dollars. But that’s nothing compared to the cost consequences of not having a SOC 2. In 2021, the average data breach cost $4.24 million. One cannot simply ignore the security and and ROI of a SOC 2 audit.
Tips for SOC 2 Compliance Success
SOC 2 compliance doesn't happen overnight. It takes time, resources, and some helpful insight. Below are some fast tips that we recommend following on your journey to preparing for a SOC 2 audit.
1. Document policies and procedures
The #1 rule in SOC 2–if it’s not documented, it didn’t happen. From hiring paperwork to security documents and incident response plans–it’s absolutely important to have evidence backed up and easily retrievable for your SOC 2 audit. This also demonstrates that your organization has property security controls in place and these processes can be easily shared with employees and management.
2. Gain support from your stakeholders
When it comes to SOC 2, it takes a village. The first step towards SOC 2 success is gaining the support from C-level executives and management. You will need this management support for your SOC 2 audit as it will require participation from the whole organization and the allocation of time and budget resources.
3. Complete a readiness assessment
When you know you need a SOC 2 report, start by conducting a readiness assessment so you can evaluate how much work you need to do to prepare for an audit.
4. Know which Trust Services Criteria to Report On
As mentioned at the beginning of this guide, there are five key areas involved in the SOC 2 audit. In most cases, organizations will choose the “common criteria” but be sure to do your research on which criteria to include beyond the initial scope: availability, confidentiality, privacy and processing integrity. Know which criteria your customers will care about the most and be sure to report on them. You can always expand your SOC 2 report to include more in the future.
5. Create an ongoing SOC compliance program
SOC 2 audits aren’t a “one and done” thing. In general, customers request updates to SOC 2 once a year to make sure you’re up to date on compliance. Thankfully, there are integrated risk management tools on the market that help you build an ongoing compliance and security program to make this a repeatable process so when it comes time to renew your SOC 2, you can save time and money in the long run.
6. Choose a reliable SOC 2 auditor
Last, but certainly not least, you’ll want to select an audit firm. When you're choosing a SOC 2 auditor, consider one that is AICPA affiliated. Research their experience in SOC 2 and other frameworks you may want to consider in the future and find out what their auditing process entails.*Ostendio is the first SaaS company to be licesned by AICPA under new software license agreement. Read more here.
.png?width=60&height=60&name=Untitled%20design%20(4).png "AICPA SOC 2")
