What Your Cloud Business Needs to Know About SOC 2 Certification

As cyber threats present greater risks to enterprises of all sizes and in all industries, more are requiring that their SaaS providers and other cloud services vendors have an SOC 2 certification. Let’s examine what an SOC 2 certification is and why your cloud services business should get one. What is an SOC 2 report? The SOC 2 is part of the American Institute of Certified Public Accountants (AICPA) Service Organization Control (SOC) reporting framework, utilizes the AT-101 professional standard, and is based on the five AICPA Trust Services Principles. Companies undergo SOC 2 audits to assure their clients that their organizations have implemented specific controls to effectively mitigate operational and compliance risks. SOC 1 vs SOC 2 vs SOC 3 An SOC 1 report utilizes the SSAE 18 standard and reports on internal controls over financial reporting (ICFR), while an SOC 2 attestation is performed in accordance with AT-101 and addresses non-financial controls. The SOC 2 was developed to meet the needs of technology service providers, so that they could attest to their adherence to comprehensive data security control procedures and practices. Distribution of SOC 1 and 2 reports is restricted to certain stakeholders, such as compliance officers, auditors, or business partners. The SOC 3 is a simplified version of an SOC 2. It reports on the same information, but the report is shorter, contains fewer details, and is meant for a general audience. Distribution of SOC 3 reports is unrestricted; they can be shared with anyone, including via posting on the company’s website. What are the AICPA Trust Services Principles? Companies undergoing an SOC 2 audit must attest to their compliance with one or more of the AICPA Trust Services Principles: * Security: Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives. * Availability: Information and systems are available for operation and use to meet the entity’s objectives. * Processing integrity: System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives. * Confidentiality: Information designated as confidential is protected to meet the entity’s objectives. * Privacy: Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives. Reporting organizations are not required to address all five Trust Service Principles; SOC 2 attestations can be limited to the principles that are relevant to the services being provided. SOC Type 1 vs Type 2 An SOC 2 Type 1 audit provides a snapshot of an organization’s controls at a point in time, while an SOC 2 Type 2 audit examines them over a specified period. Because the Type 2 is far more rigorous, this is the certification most companies will want their SaaS and cloud providers to have. The benefits of an SOC 2 Type 2 attestation Unlike regulatory standards such as PCI DSS and HIPAA, SOC 2 attestations are not required by law. However, they are well worth the investment. Companies that undergo SOC 2 Type 2 audits are demonstrating to their customers that they have comprehensive internal security controls in place and that these controls have been tested over time and proven to work. This is a major competitive differentiator in our increasingly dangerous cyber threat environment. Companies that have a choice between two cloud services vendors, one with an SOC 2 Type 2 and the other without, will choose the one with the certification. How much does an SOC 2 audit cost? The cost of an SOC 2 audit depends on your organization’s size, data environment, and current security controls.