WHAT IS SOC 2 COMPLIANCE

Everything you need to know about getting your SOC 2

Written by Om Hazela

Accorian has aided 100s of companies in attaining SOC 2 compliance through its end-to-end implementation services. Subsequently, our audit arm – Accorian Assurance, has enabled independently conducted audits and attestations to provide clients with their SOC 2 reports.

In the last few years, SOC 2 reports , have become the de facto way for service providers, especially SaaS companies, to showcase security assurance to their clients. Hence, it’s essential for companies that transmit, process, or, store client data. All SOC 2 reports contain a 3rd party auditors (CPA) opinion on the end company’s security posture against the requirements of the reporting standard (auditing procedure) along with scope information, exceptions, and deviations.

Such a report will aid in taking the cybersecurity question off the table by showcasing a level of security assurance to your clients and simplifying vendor evaluations & security due-diligence checks. Thus, allowing you to focus on the growth of your organization.

IS SOC 2 AN AUDITING PROCEDURE

SOC 2 is a reporting framework and auditing procedure, and not  a set of hard rules. It’s a set of best practices across various security attributes and domains with strong signals, that an organization needs to prioritize, encasing the criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy. These went on to formulate the TSCs (Trust Service Criteria) for SOC 2.

We would like to reiterate that a SOC 2 report does not prove that an organization is 100% secure, but, it’s a great baseline & starting point in your journey to instill security assurance and trust in your customers.

HOW DOES SOC 2 AID MODERN ORGANIZATIONS

Today’s modern organizations, especially service providers, need to showcase security assurance through attestations/certifications across various global, regional, and industry-focused security frameworks like ISO 27001, HIPAA, HITRUST, GDPR, CCPA, NIST CSF, etc.

Breaking down AICPA’s suite of SOC Reports

Soc stands for ‘System and Organization Controls.’” These were formerly called Service Organization Control reports. SOC is a suite of reports from the AICPA that CPA firms can issue in connection with system-level controls at a service organization.

SOC 1 – Report of your internal controls related to financial data & statements

SOC 2 – Report of your internal controls related to the 5 TSCs

SOC 3 – Report on the results of SOC 2 for public consumption

What is a SOC 2 Report?

  • A SOC 2 (System and Organization Control 2) report is an objective third-party review of an organization’s commitment to service, security, and trustworthiness via a System and Organization Controls (SOC) examination
  • A SOC 2 report is a confidential document with the auditor’s attestation. It is shared with end clients by organizations, especially service providers, to showcase assurance through internal controls for security and exceptions (if any). Thus, ensuring client data is secure. Since there are no exhaustive set of requirements, SOC 2 is different from several other information security standards and frameworks
  • End organizations are required to engage a SOC 2 auditor (CPA firm with AICPA membership) to review agreed-upon procedures relating to the organization’s internal controls and issue a report thereof.

TSC Examination (Trust Service Criteria)

SOC 2’s TSCs cover five key criteria across security. They are as follows – Security, Availability, Processing Integrity, Confidentiality, and Privacy.

TSC Examination (Trust Service Criteria)

The baseline TSC is Security, and is mandatory for all SOC 2 assessments. Often organizations choose the other TSCs based on the nature of their business and the assurance required to be showcased to clients. However, we would recommend your company be audited across all 5 TSCs to ensure that your organization securely manages client, sensitive & internal data. Thus, protecting the interests of the organization and its clients.

Types of SOC 2 Report:

  • A Type 1 report is typically sought after by companies that have a nascent security framework and maturity. For this report, auditors focus on the security framework (Policies, Procedures, and SOPs) and implementation of internal controls. They review the evidence and provide their feedback to capture the current posture against all the clauses. This capture also includes  exceptions, deviations, etc.The Type 1 report is a point-in-time assessment and does not assess control maturity. Hence, it’s ideal for companies that have recently implemented their security framework and controls.
  • A Type 2 report is ideal for companies who’ve designed, implemented, and achieved a steady state across a significant period of time. The auditor will assess the organization’s security framework and control implementation for maturity across a fixed period of time (the minimum is 6 months).

It is not mandatory to finish a Type 1 audit before a Type 2 audit. But, it is recommended for companies who are implementing security for the first or, have a nascent security posture.

Types of SOC 2

TYPICAL SOC 2 TIMELINE FOR SMB (PROCESS FLOW)

TYPICAL SOC 2 TIMELINE FOR SMB (PROCESS FLOW)

WHO NEEDS A SOC 2 REPORT?

  • An organization that offers services or that collects, manages, or transmits client data or, sensitive information is recommended to undergo a SOC 2 audit by an assessor. It can also be used by organizations to assess their current security posture across their security framework, control implementation
  • Numerous organizations are eligible for a SOC 2 report, including but not limited to

WHO NEEDS A SOC 2 REPORT

BENEFITS OF SOC 2 EXAMINATION REPORT

Few important benefits are as follows:

Benefits of SOC2

PREPARATION FOR SOC 2 & IT’S EXAMINATION:

While the scope of each SOC report varies from client to client, certain areas of focus are common to all SOC examinations. An organization can begin preparing its employees for a better control environment and, as a result, a more efficient SOC inspection by focusing on the following tasks.

PREPARATION FOR SOC 2

COMMON PITFALLS

COMMON PITFALLS

FINDING THE RIGHT PARTNER FOR YOUR SOC 2 JOURNEY

Choose your implementation & remediation advisory partner and, finally the auditor should be based on the following criteria

Partner

WHY CHOOSE ACCORIAN FOR SOC 2 EXAMINATION REPORT?

Accorian can aid you in achieving your SOC 2 report from start to finish. This would include:

  • Scoping
  • Gap Assessment
  • Security Framework Development: Writing and updating policies & procedures
  • Security Tool Implementation Services
  • vSecurity & vCISO Services – Short-term staff augmentation
  • Remediation Advisory with validated recommendations
  • Pre-audit
  • Type 1/Type 2 audits by our independent audit team
  • Sustenance services

We specialize in aiding service providers and SaaS companies.

Hence, regardless of where you are in your SOC journey or, your level of security compliance or, security posture, working with a team of experts helps reduce the time required to understand the framework, things to be implemented, and validated recommendations on tools & controls that need to be implemented.

Adobe’s Common Controls Framework of Industry-acclaimed security standards

Today’s world is an ever-changing scenario with changes to the technology sector happening more frequently than ever due to emerging technologies. The case is quite similar in the field of Cyber Security. There are a few industry-acclaimed cybersecurity standards for governing the processes and execution of these standards. These standards are usually built upon a framework of control objectives that need to be implemented by the organizations to comply with these standards. Compliance is measured in terms of control objectives meeting the compliance criteria and also other regulatory and statutory criteria.

Since most of these Cybersecurity standards speak of similar control objectives or lay emphasis on similar control areas, it is advisable to have the ‘Adobe’s Common Control Framework’, which means that if we are able to comply with a single requirement from a particular framework, in theory, we should be able to use the adherence of that requirement for ALL the similar frameworks. There are several approaches to achieving this Adobe’s Common Controls Framework both in theory and in practice and will be discussed in detail later on in this article. The most relevant security and privacy frameworks are ISO 27001, NIST, PCIDSS, GDPR, SOC Type 2.

There is a significant overlap of controls contained in these standards as all of these standards primarily deal with one requirement which is the protection of data. Protection of information from unauthorized disclosure, compromise, and theft forms the backbone or the building blocks of an Adobe’s Common Control Framework. This leverages the fact that similar controls or that the essence of the controls is the same across standards and can be used to gauge the adherence or compliance of an organization to the standard. In actual execution, while gauging the compliance of an organization, the Adobe’s Common Controls Framework is not only holistic but can reduce the effort and cost otherwise required by the organization to comply with individual standards.

There are two methods of developing the Adobe’s Common Control Framework for an organization and there are very subtle differences between the two methods. They are Controls harmonization and Controls Mapping.

Controls Harmonization:

Harmonization is the creation of a brand-new control language set from several source languages of standards taking into consideration content & context. In theory, the intent and meaning of the words and sentences remain intact, but the language and actual words of the individual standards have been changed with a new harmonized meaning defined. To achieve the usage of a single language as an industry, globally, it would have significant benefits and it would be the most efficient way to operate not only as security professionals but also as humans. Adobe’s Common Control Framework is an example of this type of construct. The benefits of having a single operating language can truly be amazing in terms of effort reduction and cost reduction.

Control Mapping:

Today, most brilliant and forward-thinking security professionals are using the control mapping method. The main idea behind this method is to keep the original language intact as much as possible while mapping and matching the intent and meaning of each sentence and word. This is the most practical and realistic approach because this is how humans fundamentally interact with each other globally. One can see this working in real life where two different languages are being spoken by individuals and kept mainly intact, but an interpreter or linguist is translating between the two — the map is developed in the mind of the linguist.

Some real-life examples of mapping for cybersecurity frameworks can be seen in HITRUST Framework, Cloud Security Alliance Framework, and even the U.S. Government formally uses mapping in NIST SP 800-53 Appendix H – NIST RMF to ISO 27001 Mapping Table. The benefits of control mapping are that it allows one to actually break away from a single monolithic language that is brittle when a new regulation is introduced. Control mapping is more holistic and comprehensive and aids the security professional in having a wider spectrum while implementing controls.

By now, as we have seen multiple security frameworks with rapidly emerging requirements are nothing but redundancy in controls across frameworks. Hence the way forward especially for a security consulting organization is to develop the Adobe’s Common Control Framework to gauge it’s client’s security posture comprehensively. Security risk and compliance teams are in a constant state of flux as they struggle to keep up with the ever-emerging regulations of a security framework or standard. Hence to restore stability in daily operations of compliance and security professionals, the Adobe’s Common Controls Framework is not only a savior but a game-changer too.

At Accorian, we are always committed to providing the best feasible security solution to our partners and clients as part of our service delivery. We apply Adobe Common Controls Framework (CCF) derived from multiple standards like ISO27001, PCIDSS, NIST, GDPR to gauge the security posture of an organization. Technically speaking our consultants at Accorian use Adobe Common Controls Framework (CCF) to conduct security maturity assessments of large and medium scale enterprises which in turn aid the consultants to draw out roadmaps for the elevation of the maturity level and the strategy involved in achieving it.

Risk Management Framework – Managing & Measuring what matters

A risk management program allows you to manage overall information security risk.  It is an approach to identify, quantify, mitigate, and monitor risks.  The reason to look at risk in a comprehensive manner is to make sure no one area is getting too much attention or, too little. Frameworks also help you identify the bigger elements of risk that need review and mitigation. Additionally, it help you to prioritize the treatment of certain risks. The adherence to risk frameworks also helps give your customers comfort that a standard risk management is in place and hence, reduce your audit burden. 

Typically, a Risk Management program comprises of the following phases:

  • Risk identification
  • Risk analysis
  • Risk evaluation
  • Risk treatment
  • Risk Monitoring

A good risk management framework will have the following characteristics:

  • Comprehensive in types of risks it covers
  • Practical for an organization to implement
  • Updated with current real-world risks
  • Based on controls that can be reviewed and audited
  • Reliable so that your vendors and customers can accept it

There are many risk management frameworks that one can choose from and it important to understand the advantages of each.

Common risk management frameworks include:

NIST (National Institute of Standards and Technology) framework is a comprehensive cybersecurity framework (CSF).  It is very widely accepted across different company sizes and business domains. Most cyber-security professionals are well aware of this framework as it is readily available.  Although widely available and very popular there is no certified third-party audit mechanism. Hence, it can only be self-assessed.  

SOC 2 Type 2 is an internal controls report based on the scope you define.  It is widely used in the United States to show the maturity of your controls.  A CPA firm that is part of the American Institute of CPAs (AICPA) conducts the audit & issues an assessment report.  The AICPA does not audit/review the assessment for completeness or quality. 

HITRUST CSF is a framework that came leverages NIST, SOC, and ISO along with others to create a more comprehensive standard.  It is widely implemented in the United States by organisations in the healthcare space.  Unlike others, although there are external assessors that are involved in the certification process, HITRUST reviews all assessments and issues the certificate. Additionally, among all the frameworks above it tends to be the most expensive to implement. 

It is important to choose a framework that matches your long-term security goals & needs.  At Accorian, we work with all of the above frameworks. We help organizations choose the right framework and aid with the implementation. This is done by augmenting our team into your security team to help steer the rollout, aid with query resolution, choosing of the right controls & workaround during mitigation advisory, facilitating the selection of vendors & products and end to end program management. 

Shukla CPA, d.b.a Accorian Assurance is a licensed, certified public accounting firm registered with the American Institute of Pubic Accountants (AICPA) and the Public Company Accounting Oversight Board (PCAOB). Esha IT Corp d.b.a Accorian is a global leader in cybersecurity and compliance professional services.

© 2023 Accorian. All Rights Reserved.

    Ready to Start?

    Download Case study

    Download SOC2 Guide

    Human Resources Director

    Posted On: 09 May, 2022

    Drop your CVs to joinourteam@accorian.com

      Interested Position
      First Name
      Last Name
      Email
      Total Experience
      Mobile Number
      Upload Resume