EXECUTIVE SUMMARY:

Numerous types of SOC reports for service organizations are out there. However, one of the most highly sought-after information security certifications is the SOC 2 report. This report is intended to meet the needs of enterprises that prefer detailed information and assurance.

It offers information about IT vendors’ controls as they pertain to security, and the processing integrity of the systems used to manage site visitor data. It also reports on confidentiality and privacy of data processed by the aforementioned systems.

The following article explains how to attain SOC 2 certification, offers an SOC 2 compliance checklist and additional best practices.

Benefits of SOC 2 Report – Business

If your organization provides technical solutions, earn the trust of your customers by certifying your compliance with the AICPA’s Trust Principles via an SOC 2 report. Specifically, service groups benefit from the following advantages of retaining an SOC 2 report:

• Confidence that security controls operate effectively.
• Capacity to effectively and efficiently respond to IT questionnaires from customers and partners.
• Advertising around how your businesses’ security complies with standards; providing an edge over the competition.
• Creates higher levels of trust and attracts more customers

In most cases, a client will request for a solution provider to fill out an IT questionnaire prepared by the client’s legal, InfoSec, compliance or engineering department. When such questionnaires arrive, it helps to have an SOC 2 report on-hand. This can expedite the process. Simultaneously, the report instills confidence in the client, as it points to a mature information security program.

As demand for cloud-based solutions skyrockets, SOC 2 certifications will remain as a stalwart industry standard. Having the right certifications distinguishing a business from its competitors.

Scoping SOC 2 Requirements

An SOC 2 audit scrutinizes a system and organizational controls based on the Trust Services Criteria. This criteria emerged from the Assurance Services Executive Committee (ASEC) and can be broken down into five distinctive categories.

1. Security
2. Confidentiality
3. Availability
4. Processing integrity
5. Privacy

The baseline criteria is security. It remains applicable to any industry. The other categories are supplemental in nature, and may be selected for an SOC 2 engagement based on applicability to the industry at-hand and the services rendered by a given organization.

Evaluation of SOC 2 Security Controls

Security refers to protection of:

1. Information as it is collected, created, processed, transmitted, interpreted and stored.
2. Systems that hold, process or transmit data relevant to services provided by a given organization.

The following function as the Security Common Criteria and their corresponding principles, as determined by COSO.

CC1: Control environment (COSO principles 1-5)

These principles cover the service organization’s commitment to ethics and integrity, independence by the board, management, and board oversight, along with the hiring, maintenance and ongoing monitoring of employees within the service organization.

CC2: Communication and information (COSO principles 13-15)

These include the communication of relevant details to internal staff, partners or client organizations.

CC3: Risk assessment (COSO principles 6-9)

These are intended to demonstrate that the service organization is assessing risks that may impact operations. They are also intended to show that plans exist to mitigate such risks.

CC4: Monitoring of controls (COSO principles 16-17)

These discuss the continuous evaluation of the system belonging to the service organization, along with the notification process in the event of a cyber security breach.

CC5: Control activities (COSO principles 10-12)

These test that the service organization maintains controls for the mitigation of risk. In addition, they help ensure that existing controls are monitored on an ongoing basis.

Defining SOC 2 Controls to Meet Trust Services Criteria

When defining controls for SOC 2, some of the language around AICPA’s Trust Services Criteria can prove confusing. See below for definitions of commonly confused terms:

• Minimal impact to workflow: This refers to having to divert from the ordinary process to complete a control.
• No busy work: Refers to adding extra steps in order to achieve more evidence.
• Automate-able to generate/provide: Refers to system-generated reports of user access rights.
• Empowers team members: Refers to the notion of assisting team members in performing a job while meeting a control requirement during the process.

SOC 2 Compliance Checklist: 4 Steps for Preparing for an Audit

1. Scoping. Beyond the Trust Services Criteria, other scoping considerations include a system in-scope (application or service, people, locations or entities, technology) and a timeline for having an SOC 2 report available.

If applicable to your enterprise, other security frameworks (related to industry and regulatory requirements) can be added to the SOC 2 compliance program. A few of these frameworks include: HIPAA, ISO 27001, HITRUST, NIST CSF and COBIT.

2. Self-assessment. The typical SOC 2 readiness project includes activities executed across a series of months. Hiring a part-time coordinator or contractor may prove more cost effective and operationally effective than hiring an audit firm. This is especially true if leveraging an effective connected risk platform.

3. Close gaps. Findings from an organization’s self-assessment provide insight into control gaps that need to be addressed prior to the actual SOC 2 audit. The gap remediation process typically looks as follows:

• Create missing policies and procedures
• Modifications to process workflows
• Critical security controls optimized
• Implementation of new security controls

4. Perform readiness assessment/audit. After the gap remediation process, a final readiness assessment needs to e conducted. At this point, security controls must be reassessed. Experts also advise the testing of controls and verification of functional system operations. This represents an opportunity to identify any effectiveness issues and to engage in final remediation tasks.

Best Practices for a Successful SOC 2 Audit

SOC 2 certification occurs annually. Reports generally cover a 12 month window. As a result, developing a sustainable foundation for a compliance program is critical in maintaining SOC 2 certification in the long-term.

Regardless of whether an organization’s SOC 2 initiatives reside with the IT Audit, InfoSec, Risk Management or Compliance function, creating a compliance program requires collaboration and support from a diverse set of persons and roles.

Good practices in preparing for an SOC 2 audit include:

• Assigning a staff member to drive SOC 2 readiness projects across the business.

• Including stakeholders: Executive management and other leaders across the enterprise.
• Recognizing weaknesses and assessing risks.
• Using a compliance management solution to drive workflows and take controls of the audit.

Connected Risk Solutions for Streamlining of SOC 2 Certification

Employing a cloud-based connected risk platform can help organizations save on costs and on person-power when performing an SOC 2 assessment. In addition, managing a compliance program in a solution that aligns with your organization’s needs can function as a cost-effective and efficient way to streamline a path to certification.

While that’s in motion, an organization can also reduce challenges and risks around SOC 2 by relying on spreadsheets, email and share drives. A thoughtfully constructed, purpose-built solution empowers organizations to:

• Clearly and easily scope SOC 2 requirements.
• Centralize SOC 2 compliance data in a comprehensive environment that presents a unified picture.
• Efficiently prepare for SOC 2 audits while maintaining an evidence repository and a history log of compliance activities.
• Gather all stakeholders in one place to develop and collaborate during the SOC 2 assessment process.
• Efficiently perform assessments and facilitate formal audit preparedness via automated readiness assessment programs.
• Close gaps with automated workflows
• Issue notifications to stakeholders, as needed.
• Streamline problem remediation.
• Drive the actual certification process through the use of third-party auditors who can work in a centralized platform with all pertinent data.
• Reduce costs: Both in terms of security investment expenses and labor-related costs.

Further, managing an SOC 2 program via the latest technology gives businesses the flexibility to update easily and to adopt additional compliance frameworks without impacting centralization or testing schedules. As a given organization’s compliance system develops and grows, solutions can empower your business to streamline compliance activities across multiple frameworks. This reduces administrative tasks.

Preparing for SOC 2 certification is a must, and a forward-looking compliance environment is critical to success.

Need more guidance? Get more information about SOC 2 certification here. To receive more timely cyber security best practices, news, reports and analyses, please sign up for the cybertalk.org newsletter.