Information security is a concern for every organisation, including those that outsource key business operations to third-party vendors such as SaaS and cloud providers. Rightly so, since mishandled data, especially by application and network security providers, can leave enterprises vulnerable to attacks such as data theft, extortion and malware installation.
SOC 2 is an attestation report on a service organisation’s controls, developed by the American Institute of Certified Public Accountants (AICPA). It gives customers independent assurance about how a service provider protects their data and the privacy of their clients. For security-conscious businesses, a SOC 2 report is often a minimum requirement when selecting a SaaS provider. Note that SOC 2 is not a certification: there is no certificate or pass mark, but a CPA firm’s report that includes an opinion and, for Type II, the tests performed and any exceptions found.
SOC 2 reports are issued by independent CPA firms. The auditor assesses a service organisation’s system and controls against one or more of the five categories of the AICPA’s Trust Services Criteria (2017 Trust Services Criteria, with revised points of focus 2022). There are two types of report:
- Type I reports on the description of the system and the suitability of the design of controls at a specific point in time.
- Type II also reports on the operating effectiveness of those controls over a period, typically 3 to 12 months. Most enterprise customers ask for a Type II report, renewed annually.
When should you consider a SOC 2 report? Typically when enterprise customers or prospects start asking for one in security questionnaires or contracts, when you sell into regulated sectors such as financial services and healthcare, or when you want one independent report to replace repeated customer audits. Security is required in every SOC 2; the other four categories are added based on what you promise customers.
The Trust Services Criteria categories are as follows:
1. Security
Security (the common criteria) refers to the protection of information and systems against unauthorised access, disclosure and damage. Access controls help prevent potential system abuse, theft or unauthorised removal of data, misuse of software, and improper alteration or disclosure of information.
IT security tools such as network and web application firewalls (WAFs), multi-factor authentication and intrusion detection help prevent security breaches that can lead to unauthorised access to systems and data.
2. Availability
Availability refers to the accessibility of the system, products or services as stipulated by a contract or service level agreement (SLA). As such, the minimum acceptable performance level for system availability is set by both parties.
This category does not address system functionality and usability, but does involve security-related criteria that may affect availability. Monitoring network performance and availability, site failover and security incident handling are critical in this context.
3. Processing integrity
Processing integrity addresses whether a system achieves its purpose (that is, delivers the right data at the right price at the right time). Accordingly, data processing must be complete, valid, accurate, timely and authorised.
However, processing integrity does not necessarily imply data integrity. If data contains errors before it is input into the system, detecting them is not usually the responsibility of the processing entity. Monitoring of data processing, coupled with quality assurance procedures, can help ensure processing integrity.
4. Confidentiality
Data is considered confidential if its access and disclosure are restricted to a specified set of people or organisations. Examples include data intended only for company personnel, as well as business plans, intellectual property, internal price lists and other types of sensitive financial information.
Encryption is an important control for protecting confidentiality during transmission and at rest. Network and application firewalls, together with rigorous access controls, can be used to safeguard information being processed or stored on computer systems.
5. Privacy
Privacy addresses the system’s collection, use, retention, disclosure and disposal of personal information in conformity with the organisation’s privacy notice and commitments. The privacy criteria are part of the Trust Services Criteria themselves; they replaced the AICPA’s older Generally Accepted Privacy Principles (GAPP).
Personally identifiable information (PII) refers to details that can distinguish an individual (for example name, address or Social Security number). Some personal data related to health, race, sexuality and religion is also considered sensitive and generally requires an extra level of protection. Controls must be put in place to protect all PII from unauthorised access.
Preparing for a first SOC 2 examination? Sinevis can help with readiness assessments and control remediation. Please contact us.
Source: AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022) (aicpa-cima.com).